CVE-2021-0447 (Medium) detected in linuxlinux-4.6

[mend-bolt-for-github[bot]]

CVE-2021-0447 - Medium Severity Vulnerability

Vulnerable Library - linuxlinux-4.6

The Linux Kernel

Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux

Found in HEAD commit: 7c0b143b43394df131d83e9aecb3c5518edc127a

Found in base branch: master

Vulnerable Source Files (2)

/net/l2tp/l2tp_ppp.c /net/l2tp/l2tp_ppp.c

Vulnerability Details

A security vulnerability was found in Linux Kernel before 3.2.99, 3.16.54, 4.4.225, 4.9.225 and 4.14.182. Pppol2tp_session_create() registers sessions that can't have their corresponding socket initialised.

Publish Date: 2020-11-07

URL: CVE-2021-0447

CVSS 3 Score Details (4.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.linuxkernelcves.com/cves/CVE-2021-0447

Release Date: 2020-11-07

Fix Resolution: v3.2.99,v3.16.54,v4.4.225,v4.9.225,v4.14.182,v4.15-rc1

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.