CVE-2021-3492

Katalog CVE

CVSS 7.8 · High EPSS 1,5%

Kerentanan Missing Release of Memory after Effective Lifetime pada canonical ubuntu linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.

Rincian

Terbit di NVD

17 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime
CWE-415: Double Free

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=25c891a949bf918b59cbc6e493... mailing list · patch · advisory vendor
• https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=8fee52ab9da87d82bc6de9ebb3... mailing list · patch · advisory vendor
• https://ubuntu.com/security/notices/USN-4917-1 advisory vendor
• http://packetstormsecurity.com/files/162614/Kernel-Live-Patch-Security-Notice-LSN-0077-1.html advisory pihak ketiga · vdb entry
• https://www.openwall.com/lists/oss-security/2021/04/16/2 mailing list · advisory pihak ketiga
• https://www.zerodayinitiative.com/advisories/ZDI-21-422/ advisory pihak ketiga · vdb entry