CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-28375
https://notcve.org/view.php?id=CVE-2021-28375
An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308. Se detectó un problema en el kernel de Linux versiones hasta 5.11.6. La función fastrpc_internal_invoke en el archivo drivers/misc/fastrpc.c no evita a unas aplicaciones de usuario enviar mensajes RPC del kernel, también se conoce como CID-20c40794eb85. Este es un problema relacionado con el CVE-2019-2308 • https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMRQVOTASD3VZP6GE4JJHE27QU6FHTZ6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XAUNYDTGE6MB4NWL2SIHPCODCLET3JZB https://lore.kernel.org/stable/YD03ew7+6v0XPh6l%40kroah.com https://security.netapp.com/advisory/ntap-20210401-0003 • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2021-27365 – kernel: heap buffer overflow in the iSCSI subsystem
https://notcve.org/view.php?id=CVE-2021-27365
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message. Se detectó un problema en el kernel de Linux versiones hasta 5.11.3. Determinadas estructuras de datos iSCSI no tienen restricciones de longitud o comprobaciones apropiadas y pueden exceder el valor PAGE_SIZE. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html https://bugzilla.suse.com/show_bug.cgi?id=1182715 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7ee https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 https://lists.debian.org/debian-lts-announce/2021/03&# • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 1CVE-2021-27364 – kernel: out-of-bounds read in libiscsi module
https://notcve.org/view.php?id=CVE-2021-27364
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages. Se detectó un problema en el kernel de Linux versiones hasta 5.11.3. El archivo drivers/scsi/scsi_transport_iscsi.c está afectado negativamente por la capacidad de un usuario sin privilegios de crear mensajes Netlink A flaw was found in the Linux kernel. An out-of-bounds read was discovered in the libiscsi module that could lead to reading kernel memory or a crash. The highest threat from this vulnerability is to data confidentiality as well as system availability. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html https://bugzilla.suse.com/show_bug.cgi?id=1182717 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html https://security.netapp.com&# • CWE-125: Out-of-bounds Read •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 1CVE-2021-27363 – kernel: iscsi: unrestricted access to sessions and handles
https://notcve.org/view.php?id=CVE-2021-27363
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://www.openwall.com/lists/oss-security/2021/03/06/1 https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html https://bugzilla.suse.com/show_bug.cgi?id=1182716 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html https://lists.debian.org/debian&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-28039
https://notcve.org/view.php?id=CVE-2021-28039
An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG. Se detectó un problema en el kernel de Linux versiones 5.9.x hasta 5.11.3, como es usada con Xen. En algunas configuraciones menos comunes, un usuario de Sistema Operativo invitado PV x86 puede bloquear un dominio de controlador o Dom0 por medio de una gran cantidad de actividad de I/O. • http://www.openwall.com/lists/oss-security/2021/03/05/2 http://xenbits.xen.org/xsa/advisory-369.html https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=882213990d32fd224340a4533f6318dd152be4b2 https://security.netapp.com/advisory/ntap-20210409-0001 • CWE-131: Incorrect Calculation of Buffer Size •