Vulnerability Description
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | <= 5.11.3 |
| Debian | Debian Linux | 9.0 |
| Oracle | Tekelec Platform Distribution | >= 7.4.0, <= 7.7.1 |
| Netapp | Solidfire Baseboard Management Controller Firmware | - |
| Netapp | Solidfire Baseboard Management Controller | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.htmlExploitThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1182715Issue TrackingThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecMailing ListPatchVendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9Mailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210409-0001/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/03/06/1Mailing ListThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.htmlExploitThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1182715Issue TrackingThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecMailing ListPatchVendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9Mailing ListPatchVendor Advisory
FAQ
What is CVE-2021-27365?
CVE-2021-27365 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user...
How severe is CVE-2021-27365?
CVE-2021-27365 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27365?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Debian Debian Linux, Oracle Tekelec Platform Distribution, Netapp Solidfire Baseboard Management Controller Firmware, Netapp Solidfire Baseboard Management Controller.