CVE-2021-20239: fedoraproject fedora Untrusted Pointer Dereference
Vulnerability summary
CVE-2021-20239 is a low (CVSS 3.3) Untrusted Pointer Dereference vulnerability in fedoraproject fedora. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.1% of scored vulnerabilities.
Not severe (CVSS 3.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 28-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.26% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-822Untrusted Pointer DereferenceThe product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu40 products
- linux< 5.4.0-67.75
- linux-aws< 5.4.0-1039.41
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1039.41~18.04.1
Debian1 product
- linux< 5.10.4-1
Fedoraproject1 product
- fedoraEOL33
Linux1 product
- linux_kernel< 5.4.92
Redhat1 product
- enterprise_linuxEOL5.0 | 6.0 | 8.0
5 vendors · 44 products
