PT-2021-2243
CVE-2021-27364
·
تاريخ النشر
2021-03-04
·
تاريخ التحديث
2023-05-17
الوصف من
CVSS 3.1
7.1
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.11.3
Description
The issue is related to a buffer overflow in the iSCSI subsystem of the Linux kernel, which can be exploited by sending specially crafted Netlink messages. This can allow an attacker to cause a denial of service or elevate their privileges. The
drivers/scsi/scsi transport iscsi.c file is affected, and an unprivileged user can create malicious Netlink messages. The vulnerability is also related to a lack of protection for service data, allowing an attacker to connect to the iscsi NETLINK socket and send commands to the kernel.Recommendations
For Linux kernel versions prior to 5.11.3, update to a version 5.11.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
drivers/scsi/scsi transport iscsi.c file and the iscsi NETLINK socket to minimize the risk of exploitation.
Avoid using the scsi transport iscsi.c file and the Netlink messages until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾