CVE-2021-4135

Advisory lineage Upstream: 0 Downstream: 23
Modified
Published: 14 Jul 2022, 19:30
Last modified:03 Aug 2024, 17:16

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.05% LOW
0% probability -0.07%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Jul 2022, 19:30
Published
Vulnerability first disclosed
03 Aug 2024, 17:16
Last Modified
Vulnerability information updated

Description

A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.05%• Percentile: 15%

Techniques & Countermeasures

  • CWE-401•Missing Release of Memory after Effective Lifetime

    The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

  • linux•linux_kernel

    < 5.16 | 5.16 | 5.16:rc1 | 5.16:rc2 | 5.16:rc3 | 5.16:rc4 | 5.16:rc5

References (1)