Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-3640
HistoryJul 18, 2021 - 12:00 a.m.

CVE-2021-3640

2021-07-1800:00:00
ubuntu.com
ubuntu.com
38

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel
HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other
way triggers race condition of the call sco_conn_del() together with the
call sco_sock_sendmsg() with the expected controllable faulting memory
page. A privileged local user could use this flaw to crash the system or
escalate their privileges on the system.

Bugs

Notes

Author Note
sbeattie Possibly addressed by Desmond Cheong Zhi Xi’s patchset. may need additional prerequisite commits
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-167.175UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-97.110UNKNOWN
ubuntu21.10noarchlinux< 5.13.0-28.31UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1119.127UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1064.67UNKNOWN
ubuntu21.10noarchlinux-aws< 5.13.0-1012.13UNKNOWN
ubuntu20.04noarchlinux-aws-5.11< 5.11.0-1028.31~20.04.1UNKNOWN
ubuntu20.04noarchlinux-aws-5.13< 5.13.0-1012.13~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1064.67~18.04.1UNKNOWN
ubuntu16.04noarchlinux-aws-hwe< 4.15.0-1119.126~16.04.2UNKNOWN
Rows per page:
1-10 of 591

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%