Slackware Linux update for kernel

1) Buffer overflow

EUVDB-ID: #VU60988

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-0330

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a random memory access flaw caused by a missing TLB flush in Linux kernel GPU i915 kernel driver functionality. A local user can execute arbitrary code on the system with elevated privileges.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU63666

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-38204

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local attacker to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the drivers/usb/host/max3421-hcd.c in the Linux kernel. An attacker with physical access to the system can remove a MAX-3421 USB device to perform a denial of service attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU63664

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3679

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to lack of CPU resource in the Linux kernel tracing module functionality when using trace ring buffer in a specific way. A privileged local user (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds write

EUVDB-ID: #VU57101

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37576

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a boundary error in arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform. An attacker on KVM guest OS can cause host OS memory corruption via rtas_args.nargs and execute arbitrary code on the host OS.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU59811

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2021-0920

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the unix_scm_to_skb() function of af_unix.c in Linux kernel. A local user can run a specially crafted program to trigger a race condition and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

6) Information disclosure

EUVDB-ID: #VU54395

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-21781

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the ARM SIGPAGE functionality. A userland application can read the contents of the sigpage, which can leak kernel memory contents.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Access of uninitialized pointer

EUVDB-ID: #VU92755

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-38205

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a local user to manipulate data.

drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer).

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU74548

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3732

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in the way the user mounts the TmpFS filesystem with OverlayFS. A local user can gain access to hidden files that should not be accessible.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Security restrictions bypass

EUVDB-ID: #VU56904

Risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3653

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions within the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest.

As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds write

EUVDB-ID: #VU63669

Risk: Low

CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-42008

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the decode_data() function in drivers/net/hamradio/6pack.c in the Linux kernel. A local user can send input from a process that has the CAP_NET_ADMIN capability and escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Out-of-bounds read

EUVDB-ID: #VU64210

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3753

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel. A local user can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Race condition

EUVDB-ID: #VU63667

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-40490

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Cryptographic Issues

EUVDB-ID: #VU109316

Risk: Medium

CVSSv4.0: 2.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-3702

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access top sensitive information.

The vulnerability exists due to improper input validation in WIFI driver(Krook). A remote attacker can temporary disable WPA2 or the WPA/WPA2 mixed-mode encryption and intercept traffic in clear text.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Input validation error

EUVDB-ID: #VU94152

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-20320

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Missing initialization of resource

EUVDB-ID: #VU61098

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3655

CWE-ID: CWE-909 - Missing initialization of resource

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource in the Linux kernel when processing inbound SCTP packets. A remote attacker can send specially crafted SCTP packets to the system and force the kernel to read uninitialized memory.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

EUVDB-ID: #VU63838

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4203

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in sock_getsockopt() function in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() function (and connect() function) in the Linux kernel. A local user can exploit the use-after-free error and crash the system or escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Race condition

EUVDB-ID: #VU63812

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-29374

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a race condition in the mm/gup.c and mm/huge_memory.c in Linux kernel. A local user can exploit the race and gain unauthorized access to sensitive information.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Race condition

EUVDB-ID: #VU59084

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-20321

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attacks.

The vulnerability exists due to a race condition when accessing file object in the Linux kernel OverlayFS subsystem. A local user can rename files in specific way with OverlayFS and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU63816

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3760

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the NFC stack. A local user can trigger use-after-free error to escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper Validation of Array Index

EUVDB-ID: #VU63385

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-43389

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to improper validation of array index in the ISDN CAPI implementation within detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can send specially crafted data to the system and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Insufficient verification of data authenticity

EUVDB-ID: #VU63835

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3772

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to insufficient verification of data authenticity in the Linux SCTP stack. A remote attacker can exploit this vulnerability to perform a denial of service attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Double Free

EUVDB-ID: #VU63575

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-37159

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to hso_free_net_device() function in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state. A local user can trigger double free and use-after-free errors and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Use-after-free

EUVDB-ID: #VU63764

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4202

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the nci_request() function in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. A local user can cause a data race problem while the device is getting removed and escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Use-after-free

EUVDB-ID: #VU63767

Risk: Low

CVSSv4.0: 4.8 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3752

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Linux kernel’s Bluetooth subsystem when a user calls connect to the socket and disconnect simultaneously. A local user can escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

EUVDB-ID: #VU63769

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3640

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in sco_sock_sendmsg() function of the Linux kernel HCI subsystem. A privileged local user can call ioct UFFDIO_REGISTER or other way trigger race condition to escalate privileges on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Memory leak

EUVDB-ID: #VU63836

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4002

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in the Linux kernel's hugetlbfs memory usage. A local user can force the application to leak memory and gain access to sensitive information.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use-after-free

EUVDB-ID: #VU61246

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4083

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Linux kernel's garbage collection for Unix domain socket file handlers. A local user can call close() and fget() simultaneously and can potentially trigger a race condition, which in turn leads to a use-after-free error and allows privilege escalation.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Buffer overflow

EUVDB-ID: #VU61095

Risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-39685

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a malicious host to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the USB subsystem in Linux kernel. A malicious USB device can trigger memory corruption and execute arbitrary code on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

29) Improper Resource Shutdown or Release

EUVDB-ID: #VU63584

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-28715

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Resource exhaustion

EUVDB-ID: #VU63565

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-28713

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Resource exhaustion

EUVDB-ID: #VU63564

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-28712

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Resource exhaustion

EUVDB-ID: #VU63563

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-28711

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Information disclosure

EUVDB-ID: #VU61579

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-45095

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a refcount leak within the pep_sock_accept() function in net/phonet/pep.c in the Linux kernel. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU59812

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4155

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to the OS kernel does not impose correctly security restrictions. A local user can gain access to sensitive information on the system.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Input validation error

EUVDB-ID: #VU61215

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-43976

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the mwifiex_usb_recv() function in drivers/net/wireless/marvell/mwifiex/usb.c in Linux kernel. An attacker with physical access to the system can insert a specially crafted USB device and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel.

Vulnerable software versions

Slackware Linux: 14.2

linux-4.4.301/kernel-headers: before 4.4.301_smp

linux-4.4.301/kernel-modules: before 4.4.301

linux-4.4.301/kernel-huge: before 4.4.301

linux-4.4.301/kernel-generic: before 4.4.301

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2022&m=slackware-security.852695

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	35
CVE-ID	CVE-2022-0330 CVE-2021-38204 CVE-2021-3679 CVE-2021-37576 CVE-2021-0920 CVE-2021-21781 CVE-2021-38205 CVE-2021-3732 CVE-2021-3653 CVE-2021-42008 CVE-2021-3753 CVE-2021-40490 CVE-2020-3702 CVE-2021-20320 CVE-2021-3655 CVE-2021-4203 CVE-2020-29374 CVE-2021-20321 CVE-2021-3760 CVE-2021-43389 CVE-2021-3772 CVE-2021-37159 CVE-2021-4202 CVE-2021-3752 CVE-2021-3640 CVE-2021-4002 CVE-2021-4083 CVE-2021-39685 CVE-2021-28715 CVE-2021-28713 CVE-2021-28712 CVE-2021-28711 CVE-2021-45095 CVE-2021-4155 CVE-2021-43976
CWE-ID	CWE-119 CWE-416 CWE-400 CWE-787 CWE-200 CWE-824 CWE-264 CWE-125 CWE-362 CWE-310 CWE-20 CWE-909 CWE-129 CWE-345 CWE-415 CWE-401 CWE-404
Exploitation vector	Network
Public exploit	Vulnerability #5 is being exploited in the wild. Public exploit code for vulnerability #10 is available. Public exploit code for vulnerability #28 is available.
Vulnerable software	Slackware Linux Operating systems & Components / Operating system linux-4.4.301/kernel-headers Operating systems & Components / Operating system package or component linux-4.4.301/kernel-modules Operating systems & Components / Operating system package or component linux-4.4.301/kernel-huge Operating systems & Components / Operating system package or component linux-4.4.301/kernel-generic Operating systems & Components / Operating system package or component
Vendor	Slackware