PT-2021-4244 · Linux+5 · Linux Kernel+5

Published 2021-05-21 · Updated 2023-05-17 · CVE-2021-38205

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.13.3

Description The issue is related to the drivers/net/ethernet/xilinx/xilinx emaclite.c component in the Linux kernel, which makes it easier for attackers to defeat an ASLR protection mechanism. This is because it prints a kernel pointer, specifically the real IOMEM pointer.

Recommendations For Linux kernel versions prior to 5.13.3, update to version 5.13.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable component until a patch is available.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

ALT-PU-2021-2284

ALT-PU-2021-2486

ALT-PU-2021-2616

ALT-PU-2021-3563

ALT-PU-2021-3573

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

AZL-6589

BDU:2021-04852

CVE-2021-38205

DLA-2785-1

DLA-2843-1

MGASA-2021-0409

MGASA-2021-0410

OESA-2021-1318

OPENSUSE-SU-2021:1271-1

OPENSUSE-SU-2021:3179-1

OPENSUSE-SU-2021:3205-1

OPENSUSE-SU-2021_1271-1

OPENSUSE-SU-2021_3179-1

OPENSUSE-SU-2021_3205-1

SUSE-SU-2021:3177-1

SUSE-SU-2021:3178-1

SUSE-SU-2021:3179-1

SUSE-SU-2021:3205-1

SUSE-SU-2021:3205-2

SUSE-SU-2021:3207-1

USN-5092-1

USN-5092-2

USN-5092-3

USN-5094-1

USN-5094-2

USN-5096-1

USN-5115-1

USN-5116-1

USN-5116-2

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Suse

Ubuntu

References · 268

• https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37 · Patch
• https://ubuntu.com/security/CVE-2020-3702 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6589 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0410.html · Security Note
• https://osv.dev/vulnerability/USN-5116-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3177-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38160 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38208 · Security Note
• https://ubuntu.com/security/notices/USN-5115-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38209 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3205-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38205 · Vendor Advisory