7.8

CVE-2021-37576: fedoraproject fedora Out-of-bounds Write

Modified
AliasesRHSA-2021:3436UBUNTU-CVE-2021-37576DEBIAN-CVE-2021-37576
Published 26-07-2021Last modified 04-08-2024

Vulnerability summary

CVE-2021-37576 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in fedoraproject fedora. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.57%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 42 · Related 27
DLA-2785-1DSA-4978-1OPENSUSE-SU-2021:1142-1OPENSUSE-SU-2021:2645-1OPENSUSE-SU-2021:2687-1OPENSUSE-SU-2021:3876-1

Timeline

  1. 26-07-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.57% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu18 products
  • linuxAll versions (No fix recorded) | < 4.15.0-159.167 | < 5.4.0-88.99
  • linux-aws-fips< 4.15.0-2054.56 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
  • linux-azure-edgeAll versions (No fix recorded)
  • linux-azure-fips< 4.15.0-2036.40 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1
  • linux-dell300x< 4.15.0-1028.33
Redhat15 products
  • kpatch-patch-4_18_0-305< 0:1-5.el8
  • kpatch-patch-4_18_0-305_10_2< 0:1-2.el8_4
  • kpatch-patch-4_18_0-305_10_2-debuginfo< 0:1-2.el8_4
  • kpatch-patch-4_18_0-305_10_2-debugsource< 0:1-2.el8_4
  • kpatch-patch-4_18_0-305_12_1< 0:1-1.el8_4
Debian1 product
  • linux< 5.14.6-1
Fedoraproject1 product
Linux1 product
  • linux_kernel≥ 3.10, < 4.4.277 | ≥ 4.5, < 4.9.277 | ≥ 4.10, < 4.14.241 | ≥ 4.15, < 4.19.199 | ≥ 4.20, < 5.4.136 | ≥ 5.5, < 5.10.54 | ≥ 5.11, < 5.13.6

5 vendors · 36 products

References

23 links
Show all 23 references