PT-2021-21527 · Linux+1 · Linux Kernel+1

Wade Mealing · Published 2021-11-18 · Updated 2026-04-20 · CVE-2021-3714

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw was found in the Linux kernel's memory deduplication mechanism. This issue can be exploited via a local mechanism, and the same technique can be used if an attacker can upload page-sized files and detect the change in access time from a networked service to determine if the page has been merged. The attack allows an attacker to determine the presence of specific data in memory, organize byte-by-byte leakage of memory contents, or determine the memory layout to bypass address space layout randomization (ASLR) protection. The attack can be conducted from a remote host using HTTP/1 and HTTP/2 protocols by analyzing changes in response times to sent requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-3714

ECHO-5AB0-82CF-5A66

Affected Products

Debian

Linux Kernel

References · 19

• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2021-3714 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3714 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2021-3714 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3714 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2021-3714 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3714 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2021-3714 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3714 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3714 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3714 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3714 · Vendor Advisory
• https://t.me/tmfeed/126655 · Telegram Post
• https://t.me/cvenotify/69609 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2021-3714 · Note
• https://arxiv.org/abs/2111.08553 · Note