CVE-2021-3802: fedoraproject fedora Improper Input Validation
Modified
AliasesMGASA-2021-0529SUSE-SU-2022:1919-1SUSE-SU-2022:3154-1SUSE-SU-2022:3160-1RHSA-2022:1820UBUNTU-CVE-2021-3802DEBIAN-CVE-2021-3802DLA-2809-1DLA-3387-1
Published 29-11-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-3802 is a medium (CVSS 6.3) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.3/10
010
Medium · v2.0 (NVD)EPSS score
0.91%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference
Timeline
- 29-11-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 4.5Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:HSources4 sources · 4.2–4.5
- OSV · UbuntuEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:HDiffers
- NVDNIST4.2MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:HDiffers
Medium 6.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
0.91%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 0.83% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (syss.de)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat13 products
- enterprise_linux8.0
- libudisks2< 0:2.9.0-9.el8
- libudisks2-debuginfo< 0:2.9.0-9.el8
- libudisks2-devel< 0:2.9.0-9.el8
- udisks2< 0:2.9.0-9.el8
Suse11 products
- udisks2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 2.8.1-150200.3.3.1
- udisks2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 2.9.2-150400.3.3.1
- udisks2&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.1.3-3.8.1
- udisks2&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 2.1.3-3.8.1
- udisks2&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 2.1.3-3.8.1
Mageia2 products
- libblockdev< 2.26-1.mga8
- udisks2< 2.9.4-1.mga8
Opensuse2 products
- udisks2&distro=openSUSE Leap 15.3< 2.8.1-150200.3.3.1
- udisks2&distro=openSUSE Leap 15.4< 2.9.2-150400.3.3.1
Debian1 product
- udisks2< 2.1.8-1+deb9u1 | < 2.8.1-4+deb10u1 | < 2.9.4-1
Fedoraproject1 product
- fedoraEOL34
Ubuntu1 product
- udisks2All versions (No fix recorded)
Udisks_project1 product
- udisks< 2.9.4
8 vendors · 32 products
References
25 links- www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-045.txtARTICLEREPORTExploitMitigationThird Party Advisory
