PT-2021-2219 · Connman+5 · Connman+5

Benedikt Schmotzle + 1 · Published 2021-02-08 · Updated 2024-12-16 · CVE-2021-26675

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConnMan versions prior to 1.39

Description A stack-based buffer overflow in the dnsproxy component of ConnMan could be used by network adjacent attackers to execute code. This issue allows a remote attacker to potentially execute arbitrary code.

Recommendations For versions prior to 1.39, update to version 1.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the dnsproxy component to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2021-1242

ALT-PU-2022-2468

BDU:2021-01128

CVE-2021-26675

DLA-2552-1

DSA-4847-1

MGASA-2021-0195

OPENSUSE-SU-2021:0416-1

OPENSUSE-SU-2021:0452-1

OPENSUSE-SU-2021_0416-1

OPENSUSE-SU-2024:10692-1

USN-6236-1

Affected Products

Alt Linux

Astra Linux

Connman

Linuxmint

Suse

Ubuntu

References · 57

• 🔥 https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488 · Exploit
• https://ubuntu.com/security/CVE-2021-26675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26675 · Security Note
• https://osv.dev/vulnerability/DSA-4847-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory
• https://debian.org/security/2021/dsa-4847 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0452-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0416-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0195.html · Security Note
• https://ubuntu.com/security/CVE-2022-23097 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23098 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6236-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26675 · Vendor Advisory