CVE-2021-3491: falha de alta gravidade em Linux kernel
Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.6%
probabilidade de exploração
0.6%top 50% das CVEs
exploração observada
nãonenhuma fonte reporta
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Linux · Linux kernelCVEs relacionadas — Linux kernel
No mesmo produto, das mais perigosas para as menos.
CVE-2019-11477HIGHInteger overflow in TCP_SKB_CB(skb)->tcp_gso_segsEPSS 98.7%CVE-2019-11478MEDIUMSACK can cause extensive memory use via fragmented resend queueEPSS 94.7%CVE-2019-11479MEDIUMCVE-2019-11479EPSS 91.7%CVE-2021-3490HIGHLinux kernel eBPF bitwise ops ALU32 bounds trackingEPSS 27.2%CVE-2024-24860MEDIUMRace condition vulnerability in Linux kernel bluetooth driver in {min,max}_key_size_set()EPSS 0.8%CVE-2024-24859MEDIUMRace condition vulnerability in Linux kernel bluetooth sniff_{min,max}_interval_set()EPSS 0.7%
Referências
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582dbhttps://security.netapp.com/advisory/ntap-20210716-0004/https://ubuntu.com/security/notices/USN-4949-1https://ubuntu.com/security/notices/USN-4950-1https://www.openwall.com/lists/oss-security/2021/05/11/13https://www.zerodayinitiative.com/advisories/ZDI-21-589/