Details of VAR-202112-0645

ID

VAR-202112-0645

CVE

CVE-2021-40008

TITLE

plural Huawei Vulnerability related to lack of release of resources after valid lifetime in product

Trust: 0.8

sources: JVNDB: JVNDB-2021-016239

DESCRIPTION

There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngine 7800 V200R019C00SPC800. The software does not sufficiently track and release allocated memory while parse a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust. plural Huawei The product contains a vulnerability related to lack of freeing of resources after valid lifetime.Service operation interruption (DoS) It may be in a state. Huawei CloudEngine is a data center switch of China's Huawei (Huawei) company

Trust: 2.25

sources: NVD: CVE-2021-40008 // JVNDB: JVNDB-2021-016239 // CNVD: CNVD-2021-100633 // VULMON: CVE-2021-40008

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-100633

AFFECTED PRODUCTS

vendor:	huawei	model:	cloudengine 7800	scope:	eq	version:	v200r019c00spc800	Trust: 1.0
vendor:	huawei	model:	cloudengine 12800	scope:	eq	version:	v200r019c00spc800	Trust: 1.0
vendor:	huawei	model:	cloudengine 6800	scope:	eq	version:	v200r019c00spc800	Trust: 1.0
vendor:	huawei	model:	cloudengine 5800	scope:	eq	version:	v200r019c00spc800	Trust: 1.0
vendor:	huawei	model:	cloudengine 7800	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	cloudengine 6800	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	cloudengine 5800	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	cloudengine 12800	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	cloudengine v200r019c00spc800	scope:	eq	version:	12800	Trust: 0.6
vendor:	huawei	model:	cloudengine v200r019c00spc800	scope:	eq	version:	5800	Trust: 0.6
vendor:	huawei	model:	cloudengine v200r019c00spc800	scope:	eq	version:	6800	Trust: 0.6
vendor:	huawei	model:	cloudengine v200r019c00spc800	scope:	eq	version:	7800	Trust: 0.6

sources: CNVD: CNVD-2021-100633 // JVNDB: JVNDB-2021-016239 // NVD: CVE-2021-40008

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-40008
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-40008
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2021-100633
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202112-727
value:	HIGH
Trust: 0.6
VULMON:	CVE-2021-40008
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-40008
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2021-100633
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-40008
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2021-40008
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-100633 // VULMON: CVE-2021-40008 // JVNDB: JVNDB-2021-016239 // CNNVD: CNNVD-202112-727 // NVD: CVE-2021-40008

PROBLEMTYPE DATA

problemtype:	CWE-772	Trust: 1.0
problemtype:	Lack of resource release after valid lifetime (CWE-772) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-016239 // NVD: CVE-2021-40008

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-727

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202112-727

PATCH

title:

huawei-sa-20211208-01-memleak

url:

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-memleak-en

Trust: 0.8

sources: JVNDB: JVNDB-2021-016239

EXTERNAL IDS

db:	NVD	id:	CVE-2021-40008	Trust: 3.9
db:	JVNDB	id:	JVNDB-2021-016239	Trust: 0.8
db:	CNVD	id:	CNVD-2021-100633	Trust: 0.6
db:	CS-HELP	id:	SB2021120903	Trust: 0.6
db:	CNNVD	id:	CNNVD-202112-727	Trust: 0.6
db:	VULMON	id:	CVE-2021-40008	Trust: 0.1

sources: CNVD: CNVD-2021-100633 // VULMON: CVE-2021-40008 // JVNDB: JVNDB-2021-016239 // CNNVD: CNNVD-202112-727 // NVD: CVE-2021-40008

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2021-40008	Trust: 2.0
url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-memleak-en	Trust: 1.7
url:	https://www.cybersecurity-help.cz/vdb/sb2021120903	Trust: 0.6
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20211208-01-memleak-cn	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/772.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2021-100633 // VULMON: CVE-2021-40008 // JVNDB: JVNDB-2021-016239 // CNNVD: CNNVD-202112-727 // NVD: CVE-2021-40008

CREDITS

The vulnerability was discovered by Huawei's internal testing

Trust: 0.6

sources: CNNVD: CNNVD-202112-727

SOURCES

db:	CNVD	id:	CNVD-2021-100633
db:	VULMON	id:	CVE-2021-40008
db:	JVNDB	id:	JVNDB-2021-016239
db:	CNNVD	id:	CNNVD-202112-727
db:	NVD	id:	CVE-2021-40008

LAST UPDATE DATE

2024-11-23T22:05:05.677000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-100633	date:	2021-12-17T00:00:00
db:	VULMON	id:	CVE-2021-40008	date:	2021-12-15T00:00:00
db:	JVNDB	id:	JVNDB-2021-016239	date:	2022-12-08T06:20:00
db:	CNNVD	id:	CNNVD-202112-727	date:	2021-12-22T00:00:00
db:	NVD	id:	CVE-2021-40008	date:	2024-11-21T06:23:22.150

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-100633	date:	2021-12-17T00:00:00
db:	VULMON	id:	CVE-2021-40008	date:	2021-12-13T00:00:00
db:	JVNDB	id:	JVNDB-2021-016239	date:	2022-12-08T00:00:00
db:	CNNVD	id:	CNNVD-202112-727	date:	2021-12-08T00:00:00
db:	NVD	id:	CVE-2021-40008	date:	2021-12-13T16:15:09.923