CVE-2021-4002 | Severity.io

Description

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.

Related CPE's

o

linux

linux_kernel

4

o

debian

debian_linux

2

Vulnerable

communications_cloud_native_core_binding_support_function

Vulnerable

communications_cloud_native_core_network_exposure_function

Vulnerable

communications_cloud_native_core_policy

Vulnerable

References

https://bugzilla.redhat.com/show_bug.cgi?id=2025726

Issue TrackingThird Party Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea

PatchVendor Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html

Mailing ListThird Party Advisory

https://www.debian.org/security/2022/dsa-5096

Third Party Advisory

https://www.openwall.com/lists/oss-security/2021/11/25/1

ExploitMailing ListThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

PatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2025726

Issue TrackingThird Party Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea

PatchVendor Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html

Mailing ListThird Party Advisory

https://www.debian.org/security/2022/dsa-5096

Third Party Advisory

https://www.openwall.com/lists/oss-security/2021/11/25/1

ExploitMailing ListThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

PatchThird Party Advisory

Weaknesses

[email protected]

Secondary

CWE-459

[email protected]

Primary

CWE-401

CVSS impact metrics

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.4 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2022-03-03T21:15:08.527Z

4 years ago

Last modified

2024-11-21T05:36:42.333Z

1 year ago