CVE-2021-33909 - 漏洞详情

CVE-2021-33909 (CNNVD-202107-1534)

HIGH

中文标题:

Linux kernel 输入验证错误漏洞

英文标题:

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq b...

CVSS分数: 7.8

发布时间: 2021-07-20 18:01:34

漏洞类型: 输入验证错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在输入验证错误漏洞，该漏洞源于一个越界写入缺陷。

英文描述:

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CWE类型:

CWE-190 CWE-787

受影响产品

厂商	产品	版本	版本范围	平台	CPE
linux	linux_kernel	*	-	-	`cpe:2.3:o:linux:linux_kernel::::::::`
fedoraproject	fedora	34	-	-	`cpe:2.3:o:fedoraproject:fedora:34:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
netapp	hci_management_node	-	-	-	`cpe:2.3:a:netapp:hci_management_node:-:::::::*`
netapp	solidfire	-	-	-	`cpe:2.3:a:netapp:solidfire:-:::::::*`
oracle	communications_session_border_controller	8.2	-	-	`cpe:2.3:a:oracle:communications_session_border_controller:8.2:::::::*`
oracle	communications_session_border_controller	8.3	-	-	`cpe:2.3:a:oracle:communications_session_border_controller:8.3:::::::*`
oracle	communications_session_border_controller	8.4	-	-	`cpe:2.3:a:oracle:communications_session_border_controller:8.4:::::::*`
oracle	communications_session_border_controller	9.0	-	-	`cpe:2.3:a:oracle:communications_session_border_controller:9.0:::::::*`
sonicwall	sma1000_firmware	*	-	-	`cpe:2.3:o:sonicwall:sma1000_firmware::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[debian-lts-announce] 20210720 [SECURITY] [DLA 2713-2] linux security update mailing-list
cve.org

访问

[debian-lts-announce] 20210720 [SECURITY] [DLA 2713-1] linux security update mailing-list
cve.org

访问

[debian-lts-announce] 20210720 [SECURITY] [DLA 2714-1] linux-4.19 security update mailing-list
cve.org

访问

DSA-4941 vendor-advisory
cve.org

访问

FEDORA-2021-07dc0b3eb1 vendor-advisory
cve.org

访问

[oss-security] 20210722 Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer mailing-list
cve.org

访问

[oss-security] 20210825 Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer mailing-list
cve.org

访问

[oss-security] 20210916 Containers-optimized OS (COS) membership in the linux-distros list mailing-list
cve.org

访问

[oss-security] 20210917 Re: Containers-optimized OS (COS) membership in the linux-distros list mailing-list
cve.org

访问

[oss-security] 20210920 Re: Containers-optimized OS (COS) membership in the linux-distros list mailing-list
cve.org

访问