CVE-2021-27365

תיאור (מקור, אנגלית)

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.

מדדים

CVSS 3.1

7.8 (HIGH) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787

מוצרים מושפעים

netapp: cloud backup; linux: linux kernel; debian: debian linux; oracle: tekelec platform distribution; netapp: solidfire baseboard management controller firmware; netapp: solidfire baseboard management controller

קישורים

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=‮… Mailing ListPatchVendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=‮… Mailing ListPatchVendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=‮… Mailing ListPatchVendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=‮… Mailing ListPatchVendor Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html ExploitThird Party Advisory
• https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html ExploitThird Party Advisory
• http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-‮… Third Party AdvisoryVDB Entry
• https://bugzilla.suse.com/show_bug.cgi?id=1182715 Issue TrackingThird Party Advisory