CVE-2021-3659

Description

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.12%• Percentile: 31%

Techniques & Countermeasures

• CWE-476•NULL Pointer Dereference

  The product dereferences a pointer that it expects to be valid but is NULL.

• CWE-252•Unchecked Return Value

  The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Affected Systems

• fedoraproject•fedora

  34

• linux•linux_kernel

  < 5.12

• redhat•codeready_linux_builder

  na

• redhat•enterprise_linux

  7.0 | 8.0

• redhat•enterprise_linux_for_ibm_z_systems

  8.0

• redhat•enterprise_linux_for_ibm_z_systems_eus

  8.6

• redhat•enterprise_linux_for_power_little_endian_eus

  8.6

• redhat•enterprise_linux_for_real_time

  8.0

• redhat•enterprise_linux_for_real_time_for_nfv

  8.0

• redhat•enterprise_linux_for_real_time_for_nfv_tus

  8.6

• redhat•enterprise_linux_for_real_time_tus

  8.6

• redhat•enterprise_linux_server_aus

  8.6

• redhat•enterprise_linux_server_eus

  8.6

• redhat•enterprise_linux_server_tus

  8.6

• redhat•virtualization_host

  4.0

References (3)

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8
• https://bugzilla.redhat.com/show_bug.cgi?id=1975949
• https://access.redhat.com/security/cve/CVE-2021-3659