SB2021031502 - Multiple vulnerabilities in Linux kernel Netlink implementation

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021031502

SB2021031502 - Multiple vulnerabilities in Linux kernel Netlink implementation

Published: March 15, 2021

Security Bulletin ID SB2021031502
Severity
Low
Patch available
NO
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-27364)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to iscsi_if_recv_msg() allows non-root users to connect and send commands to the Linux kernel. A local user can escalate privileges on the system.


2) Information disclosure (CVE-ID: CVE-2021-27363)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the show_transport_handle() shows iSCSI transport handle to non-root users. A local user can gain unauthorized access to sensitive information and use it along with another vulnerability, such as #VU51452, to escalate privileges on the system.


3) Buffer overflow (CVE-ID: CVE-2021-27365)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing Netlink messages in Linux kernel through 5.11.3, as certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. A local unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message, trigger memory corruption and execute arbitrary code on the system with elevated privileges.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References