ID

VAR-202103-0920


CVE

CVE-2021-27363


TITLE

Linux kernel Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202103-523

DESCRIPTION

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables. Description: Red Hat Advanced Cluster Management for Kubernetes 2.0.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. Bug fix: * RHACM 2.0.10 images (BZ #1940452) 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 1940452 - RHACM 2.0.10 images 1944286 - CVE-2021-23358 nodejs-underscore: Arbitrary code execution via the template function 5. 8.2) - aarch64, noarch, ppc64le, s390x, x86_64 3. Bug Fix(es): * System Crash / Core dump while deleting VMs (BZ#1897687) * various patches to stabilize the OPAL error log processing and the powernv dump processing (ESS) (BZ#1907302) * Unable to receive the signal registered using mq_notify(). (BZ#1926111) * SCTP "Address already in use" when no active endpoints from RHEL 8.2 onwards (BZ#1927522) * enable CONFIG_RANDOM_TRUST_CPU (BZ#1928027) * [mm] mm, oom: remove oom_lock from oom_reaper (BZ#1929739) * Configuring the system with non-RT kernel will hang the system (BZ#1930737) * fNIC driver needs a patch fix that addresses crash (BZ#1932460) * OVS mistakenly using local IP as tun_dst for VXLAN packets (?) (BZ#1944670) Enhancement(s): * mlx5: Hairpin Support in Switch Mode (BZ#1924690) * Trace mode enablement in IMC to facilitate perf-kvm support (perf:) (BZ#1929696) * ice: Enable Flow Director Support (BZ#1930780) 4. ========================================================================= Ubuntu Security Notice USN-4901-1 April 06, 2021 linux-lts-trusty vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Several security issues were fixed in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-27365) It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify data. (CVE-2020-28374) Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did not properly restrict access to iSCSI transport handles. A local attacker could use this to cause a denial of service or expose sensitive information (kernel pointer addresses). A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2021-27364) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: linux-image-3.13.0-185-generic 3.13.0-185.236~12.04.1 linux-image-generic-lts-trusty 3.13.0.185.170 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Bug Fix(es): * kernel-rt possible livelock: WARNING: CPU: 28 PID: 3109 at kernel/ptrace.c:242 ptrace_check_attach+0xdd/0x1a0 (BZ#1925308) * kernel-rt: update RT source tree to the RHEL-8.3.z3 source tree (BZ#1926369) 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2021:1071-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1071 Issue date: 2021-04-06 CVE Names: CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Security Fix(es): * kernel: out-of-bounds read in libiscsi module (CVE-2021-27364) * kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365) * kernel: iscsi: unrestricted access to sessions and handles (CVE-2021-27363) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Customer testing eMMC sees and intermittent boot problem on 7.8+, was not seen on 7.3 (BZ#1918916) * tcm loopback driver causes double-start of scsi command when work is delayed (BZ#1925652) * [Azure][RHEL-7]Mellanox Patches To Prevent Kernel Hang In MLX4 (BZ#1925691) * A patch from upstream c365c292d059 causes us to end up leaving rt_nr_boosted in an inconsistent state, which causes a hard lockup. (BZ#1928082) * [RHEL7.9.z] Add fix to update snd_wl1 in bulk receiver fast path (BZ#1929804) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1930078 - CVE-2021-27365 kernel: heap buffer overflow in the iSCSI subsystem 1930079 - CVE-2021-27363 kernel: iscsi: unrestricted access to sessions and handles 1930080 - CVE-2021-27364 kernel: out-of-bounds read in libiscsi module 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: kernel-3.10.0-1160.24.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.24.1.el7.noarch.rpm kernel-doc-3.10.0-1160.24.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.24.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.24.1.el7.x86_64.rpm perf-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: kernel-3.10.0-1160.24.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.24.1.el7.noarch.rpm kernel-doc-3.10.0-1160.24.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.24.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.24.1.el7.x86_64.rpm perf-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: kernel-3.10.0-1160.24.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.24.1.el7.noarch.rpm kernel-doc-3.10.0-1160.24.1.el7.noarch.rpm ppc64: bpftool-3.10.0-1160.24.1.el7.ppc64.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-3.10.0-1160.24.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debug-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-1160.24.1.el7.ppc64.rpm kernel-devel-3.10.0-1160.24.1.el7.ppc64.rpm kernel-headers-3.10.0-1160.24.1.el7.ppc64.rpm kernel-tools-3.10.0-1160.24.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-1160.24.1.el7.ppc64.rpm perf-3.10.0-1160.24.1.el7.ppc64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm python-perf-3.10.0-1160.24.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm ppc64le: bpftool-3.10.0-1160.24.1.el7.ppc64le.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debug-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-devel-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-headers-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-tools-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-1160.24.1.el7.ppc64le.rpm perf-3.10.0-1160.24.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm python-perf-3.10.0-1160.24.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm s390x: bpftool-3.10.0-1160.24.1.el7.s390x.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.s390x.rpm kernel-3.10.0-1160.24.1.el7.s390x.rpm kernel-debug-3.10.0-1160.24.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.s390x.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.s390x.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-1160.24.1.el7.s390x.rpm kernel-devel-3.10.0-1160.24.1.el7.s390x.rpm kernel-headers-3.10.0-1160.24.1.el7.s390x.rpm kernel-kdump-3.10.0-1160.24.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-1160.24.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-1160.24.1.el7.s390x.rpm perf-3.10.0-1160.24.1.el7.s390x.rpm perf-debuginfo-3.10.0-1160.24.1.el7.s390x.rpm python-perf-3.10.0-1160.24.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.s390x.rpm x86_64: bpftool-3.10.0-1160.24.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.24.1.el7.x86_64.rpm perf-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: bpftool-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-1160.24.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-1160.24.1.el7.ppc64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.ppc64.rpm ppc64le: bpftool-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-1160.24.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.ppc64le.rpm x86_64: bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: kernel-3.10.0-1160.24.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-1160.24.1.el7.noarch.rpm kernel-doc-3.10.0-1160.24.1.el7.noarch.rpm x86_64: bpftool-3.10.0-1160.24.1.el7.x86_64.rpm bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-devel-3.10.0-1160.24.1.el7.x86_64.rpm kernel-headers-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-1160.24.1.el7.x86_64.rpm perf-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: bpftool-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-1160.24.1.el7.x86_64.rpm perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-1160.24.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-27363 https://access.redhat.com/security/cve/CVE-2021-27364 https://access.redhat.com/security/cve/CVE-2021-27365 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYGwp7tzjgjWX9erEAQgQXQ//b1YLCLj3RXDop9pRP30zQj7xj3xDYBK5 7FLTR7K6HVYynrzKBJ87TyJkuhaPpTi8452HYHjLaYt6VYa+j1Jr+PVQr+ZaO+Rz iSRl3Sr5NYynAt9g2vNp6tfeeYPddVSpDpxkUr84EDRZ9Jg8tYtLkanRT9cH02gs +TYPCUZn/2Ii6YQjksIZmv6VVUZepMaO/kDDEi89ivGCffaMvS70Z86498XawgeM eJttBvztEv5K6wvaRtnJegmeonYKxouP1FYDyXh+WAG6zjQDcUEWUKgwdGGn+mXb k4T6F/ktCAx7wSKgt4kMvVmvzOc5jScJ2V0aK3rvm5LnqHoNin5syGOIHm6BM5Jp KTO6MGa9ex7xQdz/pNU/4aqxtKK0G4ceL8xjEGpei5U0gIEXuK4KFySa1bDQa2Xd eN2VtwzajY2tvCe7FrKuwKGb6HyIQK39C8hUHsD2x+JwLCxb12DWBY0ulJzh2C2l LPwWFWMhJqH2GG2wIKh6msCQOMJOGO3zwLtkGMj5dXrmDBHhkkT1FZnL0DdDxL3m JGija+Tr50EFGBFZvS1brChBEqwHqklkUQ3nWVXDj8ipRXJMOOGHbssw9FqnX01B qF414rmDTU1tBHc7bPo8/q5zMXKV5vOixRplzs0sw0hlBJKjvlpVpDMiseo3crlj ghAOW9EzFXk=pxZs -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.71

sources: NVD: CVE-2021-27363 // VULHUB: VHN-386598 // VULMON: CVE-2021-27363 // PACKETSTORM: 162383 // PACKETSTORM: 162247 // PACKETSTORM: 162115 // PACKETSTORM: 162108 // PACKETSTORM: 162098 // PACKETSTORM: 161973 // PACKETSTORM: 162112

AFFECTED PRODUCTS

vendor:netappmodel:cloud backupscope:eqversion: -

Trust: 1.0

vendor:linuxmodel:kernelscope:lteversion:5.11.3

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:netappmodel:solidfire baseboard management controllerscope:eqversion: -

Trust: 1.0

sources: NVD: CVE-2021-27363

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-27363
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202103-523
value: MEDIUM

Trust: 0.6

VULHUB: VHN-386598
value: LOW

Trust: 0.1

VULMON: CVE-2021-27363
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-27363
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-386598
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-27363
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 1.8
impactScore: 2.5
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-386598 // VULMON: CVE-2021-27363 // CNNVD: CNNVD-202103-523 // NVD: CVE-2021-27363

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2021-27363

THREAT TYPE

local

Trust: 0.8

sources: PACKETSTORM: 162115 // PACKETSTORM: 161973 // CNNVD: CNNVD-202103-523

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202103-523

PATCH

title:Red Hat: CVE-2021-27363url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2021-27363

Trust: 0.1

title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2021-27363 log

Trust: 0.1

title:Amazon Linux 2: ALAS2LIVEPATCH-2021-043url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2LIVEPATCH-2021-043

Trust: 0.1

title:Amazon Linux 2: ALAS2LIVEPATCH-2021-042url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2LIVEPATCH-2021-042

Trust: 0.1

title:Amazon Linux 2: ALAS2LIVEPATCH-2021-044url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2LIVEPATCH-2021-044

Trust: 0.1

title:Amazon Linux AMI: ALAS-2021-1487url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2021-1487

Trust: 0.1

title:Amazon Linux 2: ALAS2-2021-1616url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2021-1616

Trust: 0.1

title:Amazon Linux 2: ALAS2KERNEL-5.4-2022-001url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2KERNEL-5.4-2022-001

Trust: 0.1

title:IBM: Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=e9d6f12dfd14652e2bb7e5c28ded162b

Trust: 0.1

title:Presentation2_Markdownurl:https://github.com/aaronxie55/Presentation2_Markdown

Trust: 0.1

title:kernel-5.11.6-expSEHDsec-HAXM-cgroup-virtiourl:https://github.com/c4pt000/kernel-5.11.6-expSEHDsec-HAXM-cgroup-virtio

Trust: 0.1

title:kernel-5.11.6-expSEHDsec-HAXM-cgroup-virtio-nvidia-amdurl:https://github.com/c4pt000/kernel-5.11.6-expSEHDsec-HAXM-cgroup-virtio-nvidia-amd

Trust: 0.1

title:kernel-5.11.6-expSEHDsec-HAXM-cgroup-virtio-nvidia-amd-kaliwifiurl:https://github.com/c4pt000/kernel-5.11.6-expSEHDsec-HAXM-cgroup-virtio-nvidia-amd-kaliwifi

Trust: 0.1

title:kernel-5.11.6-expSEHDsec-cgroup-virtiourl:https://github.com/c4pt000/kernel-5.11.6-expSEHDsec-cgroup-virtio

Trust: 0.1

title:kernel-5.11.6-expSEHDsecurl:https://github.com/c4pt000/kernel-5.11.6-expSEHDsec

Trust: 0.1

title: - url:https://github.com/teresaweber685/book_list

Trust: 0.1

title:cve_diff_checkerurl:https://github.com/lcatro/cve_diff_checker

Trust: 0.1

title: - url:https://github.com/vincent-deng/veracode-container-security-finding-parser

Trust: 0.1

sources: VULMON: CVE-2021-27363

EXTERNAL IDS

db:NVDid:CVE-2021-27363

Trust: 2.5

db:PACKETSTORMid:162117

Trust: 1.8

db:OPENWALLid:OSS-SECURITY/2021/03/06/1

Trust: 1.8

db:PACKETSTORMid:162383

Trust: 0.8

db:PACKETSTORMid:162108

Trust: 0.8

db:PACKETSTORMid:161952

Trust: 0.7

db:PACKETSTORMid:162341

Trust: 0.7

db:PACKETSTORMid:162478

Trust: 0.7

db:PACKETSTORMid:162095

Trust: 0.7

db:PACKETSTORMid:162528

Trust: 0.7

db:PACKETSTORMid:162151

Trust: 0.7

db:PACKETSTORMid:161909

Trust: 0.7

db:PACKETSTORMid:162242

Trust: 0.7

db:PACKETSTORMid:162337

Trust: 0.7

db:CNNVDid:CNNVD-202103-523

Trust: 0.7

db:AUSCERTid:ESB-2021.1589

Trust: 0.6

db:AUSCERTid:ESB-2021.1694

Trust: 0.6

db:AUSCERTid:ESB-2021.1655

Trust: 0.6

db:AUSCERTid:ESB-2021.0837

Trust: 0.6

db:AUSCERTid:ESB-2021.1406

Trust: 0.6

db:AUSCERTid:ESB-2021.1339

Trust: 0.6

db:AUSCERTid:ESB-2021.1224

Trust: 0.6

db:AUSCERTid:ESB-2021.1307

Trust: 0.6

db:AUSCERTid:ESB-2021.1184

Trust: 0.6

db:AUSCERTid:ESB-2021.1002

Trust: 0.6

db:AUSCERTid:ESB-2021.2589

Trust: 0.6

db:AUSCERTid:ESB-2022.3346

Trust: 0.6

db:AUSCERTid:ESB-2021.1558

Trust: 0.6

db:AUSCERTid:ESB-2021.1299

Trust: 0.6

db:AUSCERTid:ESB-2021.1635

Trust: 0.6

db:AUSCERTid:ESB-2021.2136

Trust: 0.6

db:AUSCERTid:ESB-2021.1445

Trust: 0.6

db:AUSCERTid:ESB-2021.0981

Trust: 0.6

db:AUSCERTid:ESB-2021.1212

Trust: 0.6

db:AUSCERTid:ESB-2021.1151

Trust: 0.6

db:AUSCERTid:ESB-2021.1669

Trust: 0.6

db:AUSCERTid:ESB-2021.2781

Trust: 0.6

db:AUSCERTid:ESB-2021.1101

Trust: 0.6

db:CS-HELPid:SB2021051001

Trust: 0.6

db:CS-HELPid:SB2021042828

Trust: 0.6

db:CS-HELPid:SB2021050609

Trust: 0.6

db:CS-HELPid:SB2021041608

Trust: 0.6

db:CS-HELPid:SB2021041223

Trust: 0.6

db:CS-HELPid:SB2021051317

Trust: 0.6

db:CS-HELPid:SB2021042136

Trust: 0.6

db:PACKETSTORMid:162115

Trust: 0.2

db:PACKETSTORMid:161973

Trust: 0.2

db:PACKETSTORMid:162247

Trust: 0.2

db:PACKETSTORMid:162098

Trust: 0.2

db:PACKETSTORMid:162112

Trust: 0.2

db:PACKETSTORMid:162246

Trust: 0.1

db:PACKETSTORMid:162156

Trust: 0.1

db:PACKETSTORMid:162255

Trust: 0.1

db:PACKETSTORMid:162346

Trust: 0.1

db:VULHUBid:VHN-386598

Trust: 0.1

db:VULMONid:CVE-2021-27363

Trust: 0.1

sources: VULHUB: VHN-386598 // VULMON: CVE-2021-27363 // PACKETSTORM: 162383 // PACKETSTORM: 162247 // PACKETSTORM: 162115 // PACKETSTORM: 162108 // PACKETSTORM: 162098 // PACKETSTORM: 161973 // PACKETSTORM: 162112 // CNNVD: CNNVD-202103-523 // NVD: CVE-2021-27363

REFERENCES

url:https://security.netapp.com/advisory/ntap-20210409-0001/

Trust: 1.8

url:http://packetstormsecurity.com/files/162117/kernel-live-patch-security-notice-lsn-0075-1.html

Trust: 1.8

url:http://www.openwall.com/lists/oss-security/2021/03/06/1

Trust: 1.8

url:https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html

Trust: 1.8

url:https://bugzilla.suse.com/show_bug.cgi?id=1182716

Trust: 1.8

url:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa

Trust: 1.8

url:https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

Trust: 1.8

url:https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-27363

Trust: 1.3

url:https://access.redhat.com/security/cve/cve-2021-27363

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-27365

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-27364

Trust: 0.7

url:https://www.auscert.org.au/bulletins/esb-2021.0837

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021051001

Trust: 0.6

url:https://packetstormsecurity.com/files/162095/red-hat-security-advisory-2021-1070-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1589

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1445

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1307

Trust: 0.6

url:https://packetstormsecurity.com/files/162242/red-hat-security-advisory-2021-1267-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1406

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021042828

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1669

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2781

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1151

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.0981

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1212

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041223

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021042136

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1299

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1694

Trust: 0.6

url:https://packetstormsecurity.com/files/161952/ubuntu-security-notice-usn-4887-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021051317

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.3346

Trust: 0.6

url:https://packetstormsecurity.com/files/161909/ubuntu-security-notice-usn-4883-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021050609

Trust: 0.6

url:https://packetstormsecurity.com/files/162341/red-hat-security-advisory-2021-1373-01.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/linux-kernel-read-write-access-via-iscsi-show-transport-handle-34762

Trust: 0.6

url:https://packetstormsecurity.com/files/162108/red-hat-security-advisory-2021-1081-01.html

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities-4/

Trust: 0.6

url:https://packetstormsecurity.com/files/162151/red-hat-security-advisory-2021-1168-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/162478/red-hat-security-advisory-2021-1429-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041608

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1558

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1635

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1655

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2589

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1339

Trust: 0.6

url:https://packetstormsecurity.com/files/162337/red-hat-security-advisory-2021-1369-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1184

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1224

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2136

Trust: 0.6

url:https://www.ibm.com/support/pages/node/6525030

Trust: 0.6

url:https://packetstormsecurity.com/files/162528/red-hat-security-advisory-2021-1531-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1002

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1101

Trust: 0.6

url:https://packetstormsecurity.com/files/162383/red-hat-security-advisory-2021-1448-01.html

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-network-packet-capture-is-vulnerable-to-using-components-with-known-vulnerabilities-2/

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2021-27364

Trust: 0.5

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.5

url:https://access.redhat.com/security/team/contact/

Trust: 0.5

url:https://bugzilla.redhat.com/):

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2021-27365

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2021-3347

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-3347

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2020-28374

Trust: 0.4

url:https://access.redhat.com/security/team/key/

Trust: 0.4

url:https://access.redhat.com/articles/11258

Trust: 0.4

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2020-28374

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-26708

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-0466

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-27152

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-27152

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2020-0466

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-26708

Trust: 0.3

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/aaronxie55/presentation2_markdown

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-23358

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-20305

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-15586

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3449

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-3449

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-28362

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-23358

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-16845

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3450

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-3450

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-16845

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-28362

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-15586

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:1448

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-20305

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:1272

Trust: 0.1

url:https://ubuntu.com/security/notices/usn-4901-1

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:1081

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:1071

Trust: 0.1

url:https://ubuntu.com/security/notices/usn-4889-1

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:1093

Trust: 0.1

sources: VULHUB: VHN-386598 // VULMON: CVE-2021-27363 // PACKETSTORM: 162383 // PACKETSTORM: 162247 // PACKETSTORM: 162115 // PACKETSTORM: 162108 // PACKETSTORM: 162098 // PACKETSTORM: 161973 // PACKETSTORM: 162112 // CNNVD: CNNVD-202103-523 // NVD: CVE-2021-27363

CREDITS

Red Hat

Trust: 1.1

sources: PACKETSTORM: 162383 // PACKETSTORM: 162247 // PACKETSTORM: 162108 // PACKETSTORM: 162098 // PACKETSTORM: 162112 // CNNVD: CNNVD-202103-523

SOURCES

db:VULHUBid:VHN-386598
db:VULMONid:CVE-2021-27363
db:PACKETSTORMid:162383
db:PACKETSTORMid:162247
db:PACKETSTORMid:162115
db:PACKETSTORMid:162108
db:PACKETSTORMid:162098
db:PACKETSTORMid:161973
db:PACKETSTORMid:162112
db:CNNVDid:CNNVD-202103-523
db:NVDid:CVE-2021-27363

LAST UPDATE DATE

2024-11-20T21:59:19.774000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-386598date:2022-05-23T00:00:00
db:VULMONid:CVE-2021-27363date:2022-05-23T00:00:00
db:CNNVDid:CNNVD-202103-523date:2022-07-11T00:00:00
db:NVDid:CVE-2021-27363date:2022-05-23T16:00:39.467

SOURCES RELEASE DATE

db:VULHUBid:VHN-386598date:2021-03-07T00:00:00
db:VULMONid:CVE-2021-27363date:2021-03-07T00:00:00
db:PACKETSTORMid:162383date:2021-04-29T14:37:49
db:PACKETSTORMid:162247date:2021-04-20T16:18:26
db:PACKETSTORMid:162115date:2021-04-07T20:09:28
db:PACKETSTORMid:162108date:2021-04-07T20:04:40
db:PACKETSTORMid:162098date:2021-04-06T14:36:05
db:PACKETSTORMid:161973date:2021-03-25T14:09:02
db:PACKETSTORMid:162112date:2021-04-07T20:08:52
db:CNNVDid:CNNVD-202103-523date:2021-03-05T00:00:00
db:NVDid:CVE-2021-27363date:2021-03-07T04:15:13.330