CVE-2021-27365

CVSS V2 Medium 4.6 CVSS V3 High 7.8
Description
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
Overview
  • CVE ID
  • CVE-2021-27365
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2021-03-07T05:15:13
  • Last Modified Date
  • 2021-12-10T18:13:24
Weakness Enumerations
CWE URL
CWE-787 http://cwe.mitre.org/data/definitions/787.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 1 OR 5.11.3
AND
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* 1 OR 7.4.0 7.7.1
AND
cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 4.6
  • Severity
  • MEDIUM
  • Exploitability Score
  • 3.9
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 7.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 1.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 Mailing List Patch Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7ee Mailing List Patch Vendor Advisory
https://www.openwall.com/lists/oss-security/2021/03/06/1 Mailing List Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1182715 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html Mailing List Third Party Advisory
https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html Mailing List Third Party Advisory
http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20210409-0001/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2021-27365
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27365
History
Created Old Value New Value Data Type Notes
2022-05-10 06:41:46 Added to TrackCVE
2022-12-05 23:15:15 2021-03-07T05:15Z 2021-03-07T05:15:13 CVE Published Date updated
2022-12-05 23:15:15 2021-12-10T18:13:24 CVE Modified Date updated
2022-12-05 23:15:15 Analyzed Vulnerability Status updated