Out-of-bounds write in Linux kernel - CVE-2021-3501

Vulnerability identifier: #VU54316

CSH Severity: Low

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3501

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the KVM API in Linux kernel. A local user can run a specially crafted program to trigger an out-of-bounds write and escalate privileges on the system.

Linux kernel
Ubuntu
Red Hat Virtualization Host
Red Hat Virtualization
redhat-release-virtualization-host (Red Hat package)
redhat-virtualization-host (Red Hat package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.10.0-1029-oem (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-5.11.0-18-generic (Ubuntu package)
linux-image-5.11.0-18-generic-64k (Ubuntu package)
linux-image-5.11.0-18-generic-lpae (Ubuntu package)
linux-image-5.11.0-18-lowlatency (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-5.11.0-1006-azure (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-5.11.0-1007-oracle (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.11.0-1008-kvm (Ubuntu package)
linux-image-5.11.0-1008-aws (Ubuntu package)
linux-image-5.11.0-1008-gcp (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.11.0-1009-raspi-nolpae (Ubuntu package)
linux-image-5.11.0-1009-raspi (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.12
redhat-release-virtualization-host (Red Hat package) - update to 4.4.6-2.el8ev
redhat-virtualization-host (Red Hat package) - update to 4.4.6-20210615.0.el8_4
linux-image-oem-20.04b (Ubuntu package) - update to 5.10.0.1029.30
linux-image-oem-20.04 (Ubuntu package) - update to 5.10.0.1029.30
linux-image-5.10.0-1029-oem (Ubuntu package) - update to 5.10.0-1029.30
linux-image-virtual (Ubuntu package) - update to 5.11.0.18.19
linux-image-lowlatency (Ubuntu package) - update to 5.11.0.18.19
linux-image-generic-lpae (Ubuntu package) - update to 5.11.0.18.19
linux-image-5.11.0-18-generic (Ubuntu package) - update to 5.11.0-18.19
linux-image-5.11.0-18-generic-64k (Ubuntu package) - update to 5.11.0-18.19
linux-image-5.11.0-18-generic-lpae (Ubuntu package) - update to 5.11.0-18.19
linux-image-5.11.0-18-lowlatency (Ubuntu package) - update to 5.11.0-18.19
linux-image-generic-64k (Ubuntu package) - update to 5.11.0.18.19
linux-image-generic (Ubuntu package) - update to 5.11.0.18.19
linux-image-5.11.0-1006-azure (Ubuntu package) - update to 5.11.0-1006.6
linux-image-azure (Ubuntu package) - update to 5.11.0.1006.6
linux-image-oracle (Ubuntu package) - update to 5.11.0.1007.7
linux-image-5.11.0-1007-oracle (Ubuntu package) - update to 5.11.0-1007.7
linux-image-gcp (Ubuntu package) - update to 5.11.0.1008.8
linux-image-aws (Ubuntu package) - update to 5.11.0.1008.8
linux-image-gke (Ubuntu package) - update to 5.11.0.1008.8
linux-image-kvm (Ubuntu package) - update to 5.11.0.1008.8
linux-image-5.11.0-1008-kvm (Ubuntu package) - update to 5.11.0-1008.8
linux-image-5.11.0-1008-aws (Ubuntu package) - update to 5.11.0-1008.8
linux-image-5.11.0-1008-gcp (Ubuntu package) - update to 5.11.0-1008.9
linux-image-raspi (Ubuntu package) - update to 5.11.0.1009.7
linux-image-raspi-nolpae (Ubuntu package) - update to 5.11.0.1009.7
linux-image-5.11.0-1009-raspi-nolpae (Ubuntu package) - update to 5.11.0-1009.10
linux-image-5.11.0-1009-raspi (Ubuntu package) - update to 5.11.0-1009.10

• https://bugzilla.redhat.com/show_bug.cgi?id=1950136
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a

• Privilege escalation in Linux KVM API
• Red Hat Virtualization Host security update for ovirt
• Ubuntu update for linux
• Ubuntu update for linux-oem-5.10