PT-2021-22680 · Google+1 · Android Kernel+1

Published 2021-12-15 · Updated 2022-07-12 · CVE-2021-39636

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Android kernel

Description: The issue is related to the do ipt get ctl and do ipt set ctl functions in ip tables.c, where uninitialized data can lead to a leak of kernel information. This could result in local information disclosure, requiring system execution privileges for exploitation. No user interaction is needed for exploitation.

Recommendations: For Android kernel, consider applying the upstream kernel fix to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2021-39636

USN-5361-1

Affected Products

Android Kernel

Ubuntu

References · 23

• https://cve.org/CVERecord?id=CVE-2021-39636 · Security Note
• https://ubuntu.com/security/CVE-2021-31916 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28964 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12888 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-3702 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-0920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39636 · Security Note
• https://ubuntu.com/security/notices/USN-5361-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42739 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4083 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45486 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26141 · Vendor Advisory