PT-2021-6205 · Linux+3 · Linux Kernel+3

Wenqing Liu · Published 2021-12-22 · Updated 2023-08-14 · CVE-2021-45469

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.15.11

Description The issue arises from an out-of-bounds memory access in the f2fs setxattr function in fs/f2fs/xattr.c when an inode has an invalid last xattr entry. This can potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions through 5.15.11, update to a version later than 5.15.11 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2021-3644

ALT-PU-2022-1015

ALT-PU-2022-1016

ALT-PU-2022-1026

ALT-PU-2022-1051

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

ALT-PU-2023-4894

AZL-7073

BDU:2022-01121

CVE-2021-45469

DLA-2941-1

DSA-5050-1

DSA-5096-1

MGASA-2021-0588

OESA-2022-1484

USN-5343-1

USN-5377-1

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Ubuntu

References · 117

• 🔥 https://bugzilla.kernel.org/show_bug.cgi?id=215235 · Exploit
• 🔥 https://git.kernel.org/pub/scm/linux/kernel/git/chao/linux.git/commit/?h=dev&id=5598b24efaf4892741c798b425d543e4bed357a1 · Exploit
• https://ubuntu.com/security/CVE-2022-1055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28712 · Security Note
• https://osv.dev/vulnerability/USN-5377-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43976 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4135 · Security Note
• https://ubuntu.com/security/CVE-2020-26139 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0941 · Security Note
• https://ubuntu.com/security/CVE-2021-28713 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-0129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45469 · Security Note