[email protected]CVE-2021-26931

HistoryFeb 17, 2021 - 2:15 a.m.

CVE-2021-26931

2021-02-1702:15:00

CWE-770

[email protected]

web.nvd.nist.gov

212

cve-2021-26931

linux kernel

xen

kernel crash

memory allocation

out of memory

nvd

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.8 Medium

AI Score

Confidence

High

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

13.3%

JSON

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn’t correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.

CPENameOperatorVersion
linux:linux_kernellinux linux kernelle5.10.16
fedoraproject:fedorafedoraproject fedoraeq32
fedoraproject:fedorafedoraproject fedoraeq33
debian:debian_linuxdebian debian linuxeq9.0

CPE	Name	Operator	Version
linux:linux_kernel	linux linux kernel	le	5.10.16
fedoraproject:fedora	fedoraproject fedora	eq	32
fedoraproject:fedora	fedoraproject fedora	eq	33
debian:debian_linux	debian debian linux	eq	9.0