CVE-2021-20265: linux linux_kernel Uncontrolled Resource Consumption
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2021-20265DEBIAN-CVE-2021-20265CGA-22p8-6j4q-g6p4CGA-2fcg-m3xq-xrq2CGA-2ppr-rq9f-p3cwCGA-2r6g-m3f2-54f6CGA-2r75-3wxx-mh4jCGA-2vq5-2h7x-x4w8CGA-2x6w-jxwc-m2qwCGA-32g4-98h6-559vCGA-332f-3wx8-8gg4CGA-34hv-x22j-6q74CGA-35cr-2jxf-mwppCGA-3c8q-x36h-rj4qCGA-3fj4-ppf9-54vxCGA-3fp7-w6jg-49fmCGA-3hfp-25ww-x3ppCGA-3q8p-7jw8-qxp9CGA-3wh8-28gc-hf2vCGA-423v-m59v-h7mgCGA-46x3-gw9q-79hfCGA-4hhv-4f94-qxj8CGA-4v8j-8c79-h54qCGA-4vf7-3gvf-cg84CGA-4x4v-8j57-76hqCGA-4xh2-2p33-qjh2CGA-5295-whcj-8gmxCGA-53qc-2cvh-48j6CGA-548g-87vq-3q47CGA-5994-h795-qmhfCGA-5fhf-7w5x-mmxfCGA-5g3m-462w-6chvCGA-5gjq-3f2v-3936CGA-5hx6-chq5-m54qCGA-5mgv-59v9-5446CGA-5ppm-v39g-2m6fCGA-5q3h-88r4-rcx3CGA-5vrj-h7gg-fhqpCGA-5vxv-r374-p2xfCGA-5w48-6wm6-rh3qCGA-5wvf-jx2c-382hCGA-64h5-v24f-rcjpCGA-65g8-3r94-m6j8CGA-6648-9r3q-mm72CGA-66w5-87jq-3qwwCGA-66wm-6vh9-w35jCGA-69m8-2h4m-4m4qCGA-6f77-gp9j-xcwrCGA-6ffm-j2vv-gxpfCGA-6fg6-h39c-fvxgCGA-6j6j-47gq-652gCGA-7r9c-34r3-jpp2CGA-7whp-2xfm-pxqwCGA-8556-98vr-42q8CGA-85vx-gfhc-w967CGA-86m3-gm6j-jqj4CGA-89q8-g87q-2mwgCGA-8f68-4fv7-2964CGA-8j4v-8h6p-r7q7CGA-8qcj-wv7w-cg8hCGA-8r8c-gjfh-235hCGA-936q-gcjx-rp44CGA-93jv-hj72-vxrfCGA-9932-5c98-whhwCGA-999m-87hg-p4r5CGA-9ccc-4jwf-j9gfCGA-9f5c-w69q-4frrCGA-9m55-3v6p-fg3pCGA-9qqc-j59g-c64vCGA-9xhp-3g4c-g79jCGA-c38f-3h2p-5pxpCGA-c4g8-cww8-9wcmCGA-c758-f86j-9h4mCGA-cjff-v77p-557qCGA-cmph-gh43-f3grCGA-f6x9-m3x4-2qq2CGA-fcqw-mmm7-g683CGA-fcrw-4qg3-hm36CGA-fgfp-xjhh-7qmwCGA-fgpx-vxvw-h9r9CGA-fqxh-wcw6-7422CGA-fvg7-5p2g-4cxfCGA-fw39-75jv-3g3rCGA-gch4-5rrr-qxm3CGA-gfj6-gwr3-fv3cCGA-gwp7-36h7-x5h5CGA-h8p6-3448-xr73CGA-hgv6-jjhg-3m8hCGA-hvfh-8v3v-xh2gCGA-j34q-p2w4-8vg9CGA-j55q-x52v-94fqCGA-j64v-5c82-73c9CGA-jcp4-7p37-38ccCGA-jg2p-ch6f-6jpvCGA-jg87-r967-cc4fCGA-jpmp-rfmr-xfj2CGA-jrr8-7j3h-h9x4CGA-m2j2-q9wg-774cCGA-m652-46p3-9mm4CGA-m8hf-6h63-jpvcCGA-m8j4-g7cv-f238CGA-mcqf-547f-vcm9CGA-mfpc-9hh8-339jCGA-mfv8-p877-74r5CGA-mgmp-8cmp-wg89CGA-mq2m-gwx8-fwp6CGA-mxg3-pwp7-mqg3CGA-p2jj-chgf-p529CGA-p4cq-84wp-w6vhCGA-p4r5-29j8-hvw6CGA-pc72-x84r-x2fqCGA-pfgf-3j7f-fjcvCGA-pm7w-3fpv-rhrcCGA-pm9j-42rx-q2gpCGA-prf7-ch2v-r445CGA-wg96-v5c4-gjmqCGA-pxv5-463w-p6jxCGA-q32m-qhjx-6qqjCGA-q6fg-cg3c-x9r8CGA-q6h3-r2f9-52p9CGA-qc49-r43h-x93cCGA-qwrv-xh6q-q652CGA-r2jf-rxxf-pm84CGA-r4vq-8jg2-hmgmCGA-r5j3-pq8f-x527CGA-r875-wv6r-2h49CGA-rg3m-6553-c3g4CGA-rh5x-g86j-5w7jCGA-rmp9-cxjp-2vp5CGA-v2hq-vqwp-rg25CGA-v7xj-q6qf-8cj9CGA-vfrh-q9rm-53wwCGA-vgr6-jc55-q6c7CGA-vm52-jh9c-3vwcCGA-vmwg-x459-qc39CGA-vw93-q3h4-prfrCGA-w2gf-5235-p2hxCGA-w2xx-94gx-pw3qCGA-w3c4-x546-5cj5CGA-w5j6-3c99-5fp4CGA-w7mr-php4-58c9CGA-w7v3-gqv7-9w2vCGA-wcfc-6c26-qg43CGA-wjj5-43r6-rx76CGA-wjr4-pq6g-cjqfCGA-wm35-mv46-prxjCGA-wqff-v48q-6773CGA-wqgc-2qhv-p5vmCGA-x8rw-mwfr-q9wfCGA-xfxq-p285-v34gCGA-xj49-9fx5-m9mqCGA-xq9c-wrvf-9xx8CGA-xv3h-6wfq-292mCGA-xvrp-36w3-pv64CGA-xvxf-jh2q-9vh8CGA-343x-3hhg-r8vgCGA-5g45-hjcv-vf6mCGA-6g3f-f778-j97fCGA-chg5-jhc3-cx5cCGA-gh48-9w2q-8gj4CGA-h9xx-x5m5-frpvCGA-hmfj-hq74-7vjcCGA-r2mv-2vgw-3jm4
Published 10-03-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-20265 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in linux linux_kernel. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 10-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 4.9Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 19-09-2026
19-09-202619-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
Chainguard78 products
- hyperv-daemons-6.18All versions (No fix recorded)
- hyperv-daemons-genericAll versions (No fix recorded)
- linux-aws-6.12< 6.12.65-r0 | All versions (No fix recorded)
- linux-aws-6.12-boot-installedAll versions (No fix recorded)
- linux-aws-6.12-fips-boot-installedAll versions (No fix recorded)
Ubuntu19 products
- linuxAll versions (No fix recorded)
- linux-awsAll versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-azureAll versions (No fix recorded)
Debian1 product
- linux< 4.4.4-1
Linux1 product
Oracle1 product
- tekelec_platform_distribution≥ 7.4.0, ≤ 7.7.1
5 vendors · 100 products
References
7 links- bugzilla.redhat.com/show_bug.cgi?id=1908827X Refsource MISCFIXIssue TrackingPatchThird Party Advisory
