search

AbrarKhan / Linux-4.19.72

Other
0 stars 0 forks source link

CVE-2021-28712 (Medium) detected in linuxlinux-4.19.87 #450

Open mend-bolt-for-github[bot] opened 2 months ago

mend-bolt-for-github[bot] commented 2 months ago

CVE-2021-28712 - Medium Severity Vulnerability

Vulnerable Library - linuxlinux-4.19.87

The Linux Kernel

Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux

Found in HEAD commit: 57e05824dcb3cd61bc82b1e93e4409de26d2caba

Found in base branch: master

Vulnerable Source Files (2)

/drivers/net/xen-netfront.c /drivers/net/xen-netfront.c

Vulnerability Details

Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically referred to as "driver domains". Running PV backends in driver domains has one primary security advantage: if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. There are three affected backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch 3, CVE-2021-28713

Publish Date: 2022-01-05

URL: CVE-2021-28712

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.linuxkernelcves.com/cves/CVE-2021-28712

Release Date: 2022-01-05

Fix Resolution: v4.4.296,v4.9.294,v4.14.259,v4.19.222,v5.4.168,v5.10.88,v5.15.11,v5.16-rc7

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 2 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] commented 1 month ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.