CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-4145 – QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c
https://notcve.org/view.php?id=CVE-2021-4145
A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node. Se encontró un problema de desreferencia de puntero NULL en la capa de réplica de bloques de QEMU en versiones anteriores a 6.2.0. El puntero "self" es dereferenciado en mirror_wait_on_conflicts() sin asegurar que no sea NULL. • https://bugzilla.redhat.com/show_bug.cgi?id=2034602 https://gitlab.com/qemu-project/qemu/-/commit/66fed30c9cd11854fc878a4eceb507e915d7c9cd https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20220311-0004 https://access.redhat.com/security/cve/CVE-2021-4145 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2021-3905
https://notcve.org/view.php?id=CVE-2021-3905
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments. Se ha encontrado una pérdida de memoria en Open vSwitch (OVS) durante el procesamiento de la fragmentación IP en el espacio de usuario. Un atacante podría usar este fallo para agotar potencialmente la memoria disponible al seguir enviando fragmentos de paquetes. • https://access.redhat.com/security/cve/CVE-2021-3905 https://bugzilla.redhat.com/show_bug.cgi?id=2019692 https://github.com/openvswitch/ovs-issues/issues/226 https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349 https://security.gentoo.org/glsa/202311-16 https://ubuntu.com/security/CVE-2021-3905 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 2CVE-2021-4154 – kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout
https://notcve.org/view.php?id=CVE-2021-4154
A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system. Se encontró un defecto de uso de memoria previamente liberada en la función cgroup1_parse_param en el archivo kernel/cgroup/cgroup-v1.c en el analizador cgroup v1 del kernel de Linux. Un atacante local con un privilegio de usuario podría causar una escalada de privilegios al explotar el parámetro de syscall fsconfig, conllevando a una ruptura del contenedor y una denegación de servicio en el sistema • https://github.com/Markakd/CVE-2021-4154 https://github.com/veritas501/CVE-2021-4154 https://bugzilla.redhat.com/show_bug.cgi?id=2034514 https://cloud.google.com/anthos/clusters/docs/security-bulletins#gcp-2022-002 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b https://security.netapp.com/advisory/ntap-20220225-0004 https://access.redhat.com/security/cve/CVE-2021-4154 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 3CVE-2021-45417 – aide: heap-based buffer overflow on outputs larger than B64_BUF
https://notcve.org/view.php?id=CVE-2021-45417
AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. AIDE versiones anteriores a 0.17.4, permite a usuarios locales obtener privilegios de root por medio de metadatos de archivo diseñados (como atributos extendidos de XFS o ACLs de tmpfs), debido a un desbordamiento de búfer en la región heap de la memoria A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could crash the program and possibly execute arbitrary code through large (<16k) extended file attributes or ACL. • http://www.openwall.com/lists/oss-security/2022/01/20/3 https://lists.debian.org/debian-lts-announce/2022/01/msg00024.html https://security.gentoo.org/glsa/202311-07 https://www.debian.org/security/2022/dsa-5051 https://www.ipi.fi/pipermail/aide/2022-January/001713.html https://www.openwall.com/lists/oss-security/2022/01/20/3 https://access.redhat.com/security/cve/CVE-2021-45417 https://bugzilla.redhat.com/show_bug.cgi?id=2041489 • CWE-787: Out-of-bounds Write •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-3827 – CVE-2021-3827 keycloak-server-spi-private: ECP SAML binding bypasses authentication flows
https://notcve.org/view.php?id=CVE-2021-3827
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity. Se ha encontrado un fallo en keycloak, en el que el flujo de vinculación ECP por defecto permite omitir otros flujos de autenticación. Al explotar este comportamiento, un atacante puede omitir la autenticación MFA mediante el envío de una petición SOAP con un encabezado AuthnRequest y Authorization con las credenciales del usuario. • https://access.redhat.com/security/cve/CVE-2021-3827 https://bugzilla.redhat.com/show_bug.cgi?id=2007512 https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v • CWE-287: Improper Authentication •