PT-2021-8070 · Linux+2 · Linux Kernel+2

Published 2021-12-30 · Updated 2024-08-13 · CVE-2021-46923

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the finish mount kattr() function in the Linux kernel's mount kattr component. It is caused by an error in the function's operation, which can lead to leaking references when building mount kattr, especially when an idmapped mount is requested and path lookup fails. This could allow an attacker to obtain confidential information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2024-06276

CVE-2021-46923

OPENSUSE-SU-2024_0858-1

SUSE-SU-2024:0855-1

SUSE-SU-2024:0858-1

SUSE-SU-2024:0900-1

SUSE-SU-2024:0900-2

SUSE-SU-2024:0910-1

SUSE-SU-2024:0977-1

Affected Products

Linux Kernel

Red Os

Suse

References · 157

• https://ubuntu.com/security/CVE-2021-46923 · Vendor Advisory
• https://git.kernel.org/stable/c/012e332286e2bb9f6ac77d195f17e74b2963d663 · Patch
• https://bdu.fstec.ru/vul/2024-06276 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46923 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46923 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0855-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0910-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0858-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46923 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0900-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46923 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0900-1 · Vendor Advisory
• https://git.kernel.org/stable/c/47b5d0a7532d39e42a938f81e3904268145c341d · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-46923 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46923 · Vendor Advisory