Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47164
HistoryMar 25, 2024 - 12:00 a.m.

CVE-2021-47164

2024-03-2500:00:00
ubuntu.com
ubuntu.com
3
linux kernel
net/mlx5e
vulnerability
fix
null deref
bond_enslave
upper dev
event
unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix null deref accessing lag dev It could be the lag dev is null
so stop processing the event. In bond_enslave() the active/backup slave
being set before setting the upper dev so first event is without an upper
dev. After setting the upper dev with bond_master_upper_dev_link() there is
a second event and in that event we have an upper dev.

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%