CVE-2021-21781CWE-908

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54

Medium · published August 18, 2021

CVSS v3.0
4.0
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11

The record
Technical detail
CVSS v3.0
4.0 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00496 · 41.7th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2021-08-18T14:37Z
EPSS history
Timeline
  • 18 AUG 14:37Z
    An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54
    cvelistv5