CVE-2021-21781

Published: Aug 18, 2021Modified: Nov 21, 2024

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11

Affected (5)

Products: Linux: Linux Kernel · Oracle: Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Network Exposure Function, Communications Cloud Native Core Policy

Linux

1 product

Linux Kernel

Oracle

3 products

Communications Cloud Native Core Binding Support Function

Communications Cloud Native Core Network Exposure Function

Communications Cloud Native Core Policy

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Version 5.4.54
Linux Linux Kernel	Version 5.4.66

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Binding Support Function	Version 22.1.3
Oracle Communications Cloud Native Core Network Exposure Function	Version 22.1.1
Oracle Communications Cloud Native Core Policy	Version 22.2.0