CVE-2021-27363: debian debian_linux

Modified

AliasesUBUNTU-CVE-2021-27363DEBIAN-CVE-2021-27363

Published 07-03-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-27363 is a medium (CVSS 4.4) vulnerability in debian debian_linux. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 4.4, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.4/10

010

Medium · v3.1 (NVD)

EPSS score

0.71%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Timeline

07-03-2021
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.14.4v2.03.6

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.71% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (blog.grimm-co.com)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu51 products

linux< 3.13.0-185.236 | < 4.4.0-206.238 | < 4.15.0-139.143 | < 5.4.0-70.78
linux-aws< 4.4.0-1088.92 | < 4.4.0-1124.138 | < 4.15.0-1096.103 | < 5.4.0-1041.43
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1041.43~18.04.1

linux-aws-fips< 4.15.0-2039.41 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
linux-aws-hwe< 4.15.0-1096.103~16.04.1
linux-azure< 4.15.0-1110.122~14.04.1 | < 4.15.0-1110.122~16.04.1 | All versions (No fix recorded) | < 5.4.0-1043.45
linux-azure-4.15< 4.15.0-1110.122
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1043.45~18.04.1
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fde-5.15< 5.15.0-1114.123~20.04.1
linux-azure-fips< 4.15.0-2022.25 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1
linux-dell300x< 4.15.0-1015.19
linux-fips< 4.4.0-1058.64 | All versions (No fix recorded) | < 4.15.0-1055.63
linux-gcp< 4.15.0-1095.108~16.04.1 | All versions (No fix recorded) | < 5.4.0-1040.43
linux-gcp-4.15< 4.15.0-1095.108
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1040.43~18.04.1
linux-gcp-edgeAll versions (No fix recorded)
linux-gcp-fipsAll versions (No fix recorded) | < 5.4.0-1067.71~20.04.1
linux-gke< 5.4.0-1039.41
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.3< 5.3.0-1041.44
linux-gke-5.4< 5.4.0-1039.41~18.04.1
linux-gkeop< 5.4.0-1012.13
linux-gkeop-5.4< 5.4.0-1012.13~18.04.1
linux-hwe< 4.15.0-139.143~16.04.1 | < 5.3.0-72.68
linux-hwe-5.4< 5.4.0-70.78~18.04.1
linux-hwe-5.8< 5.8.0-48.54~20.04.1
linux-hwe-edgeAll versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-kvm< 4.4.0-1090.99 | < 4.15.0-1087.89 | < 5.4.0-1036.37
linux-lts-xenial< 4.4.0-206.238~14.04.1
linux-oemAll versions (No fix recorded)
linux-oem-5.10< 5.10.0-1019.20
linux-oem-5.6< 5.6.0-1052.56
linux-oracle< 4.15.0-1067.75~16.04.1 | < 4.15.0-1067.75 | < 5.4.0-1041.44
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1041.44~18.04.1
linux-raspi< 5.4.0-1032.35
linux-raspi-5.4< 5.4.0-1032.35~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2< 4.4.0-1148.158 | < 4.15.0-1081.86 | All versions (No fix recorded)
linux-raspi2-5.3< 5.3.0-1038.40
linux-realtimeAll versions (No fix recorded)
linux-riscvAll versions (No fix recorded)
linux-riscv-5.8< 5.8.0-20.22~20.04.1
linux-snapdragon< 4.4.0-1152.162 | < 4.15.0-1098.107