CVE-2021-4135CWE-200CWE-401information-disclosure

CVE-2021-4135

Medium · published July 15, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2022-07-15T00:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel< 5.165.16
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53 · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 14 JUL 19:30Z
    A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that…
    cvelistv5