Vulnerability Details : CVE-2021-4002
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.
Vulnerability category: Bypass
Products affected by CVE-2021-4002
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-4002
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 8 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-4002
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.6
|
LOW | AV:L/AC:L/Au:N/C:P/I:P/A:N |
3.9
|
4.9
|
NIST | |
|
4.4
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
1.8
|
2.5
|
NIST |
CWE ids for CVE-2021-4002
-
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2021-4002
-
https://bugzilla.redhat.com/show_bug.cgi?id=2025726
2025726 – (CVE-2021-4002) CVE-2021-4002 kernel: possible leak or coruption of data residing on hugetlbfsIssue Tracking;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
[SECURITY] [DLA 2940-1] linux security updateMailing List;Third Party Advisory
-
https://www.debian.org/security/2022/dsa-5096
Debian -- Security Information -- DSA-5096-1 linuxThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
[SECURITY] [DLA 2941-1] linux-4.19 security updateMailing List;Third Party Advisory
-
https://www.openwall.com/lists/oss-security/2021/11/25/1
oss-security - CVE-2021-4002: Linux kernel: Missing TLB flush on hugetlbfsExploit;Mailing List;Third Party Advisory
-
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
https://www.oracle.com/security-alerts/cpujul2022.html
Oracle Critical Patch Update Advisory - July 2022Patch;Third Party Advisory
Jump to