PT-2021-3701 · Linux+2 · Linux Kernel+2
Nayna
·
Published
2021-06-22
·
Updated
2023-05-16
·
CVE-2021-35039
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.12.14
Description
The issue is related to the mishandling of Signature Verification in the Linux kernel. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information. The problem occurs when the
module.sig enforce=1 command-line argument is used without CONFIG MODULE SIG, resulting in a lack of verification that a kernel module is signed before loading it via init module.Recommendations
For Linux kernel versions prior to 5.12.14, update to version 5.12.14 or later to resolve the issue. As a temporary workaround, consider enabling
CONFIG MODULE SIG to ensure signature verification for kernel modules. Restrict the use of the module.sig enforce=1 command-line argument until the update is applied.Fix
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linux Kernel
Suse