CVE-2021-3744 - 漏洞详情

CVE-2021-3744 (CNNVD-202109-1000)

MEDIUM

中文标题:

Linux kernel 安全漏洞

英文标题:

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/cr...

CVSS分数: 5.5

发布时间: 2022-03-04 15:55:17

漏洞类型: 其他

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于内存泄漏，导致系统拒绝服务。

英文描述:

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.

CWE类型:

CWE-401

受影响产品

厂商	产品	版本	版本范围	平台	CPE
linux	linux_kernel	*	-	-	`cpe:2.3:o:linux:linux_kernel::::::::`
linux	linux_kernel	5.15	-	-	`cpe:2.3:o:linux:linux_kernel:5.15:-::::::`
fedoraproject	fedora	33	-	-	`cpe:2.3:o:fedoraproject:fedora:33:::::::*`
fedoraproject	fedora	34	-	-	`cpe:2.3:o:fedoraproject:fedora:34:::::::*`
fedoraproject	fedora	35	-	-	`cpe:2.3:o:fedoraproject:fedora:35:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
redhat	build_of_quarkus	2.0	-	-	`cpe:2.3:a:redhat:build_of_quarkus:2.0:::::::*`
redhat	codeready_linux_builder	8.0	-	-	`cpe:2.3:a:redhat:codeready_linux_builder:8.0:::::::*`
redhat	codeready_linux_builder_eus	8.6	-	-	`cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:::::::*`
redhat	codeready_linux_builder_for_power_little_endian	8.0	-	-	`cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:::::::*`
redhat	codeready_linux_builder_for_power_little_endian_eus	8.6	-	-	`cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:::::::*`
redhat	developer_tools	1.0	-	-	`cpe:2.3:a:redhat:developer_tools:1.0:::::::*`
redhat	enterprise_linux_eus	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*`
redhat	enterprise_linux_for_ibm_z_systems_eus	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:::::::*`
redhat	enterprise_linux_for_power_little_endian_eus	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:::::::*`
redhat	enterprise_linux_for_real_time	8	-	-	`cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:::::::*`
redhat	enterprise_linux_for_real_time	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_for_real_time:8.6:::::::*`
redhat	enterprise_linux_for_real_time_for_nfv	8	-	-	`cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:::::::*`
redhat	enterprise_linux_for_real_time_for_nfv_tus	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.6:::::::*`
redhat	enterprise_linux_server_eus	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_server_eus:8.6:::::::*`
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:::::::*`
redhat	enterprise_linux_server_tus	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*`
redhat	enterprise_linux_server_update_services_for_sap_solutions	8.6	-	-	`cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:::::::*`
redhat	virtualization_host	4.0	-	-	`cpe:2.3:a:redhat:virtualization_host:4.0:::::::*`
oracle	communications_cloud_native_core_binding_support_function	22.1.3	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:::::::*`
oracle	communications_cloud_native_core_network_exposure_function	22.1.1	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:::::::*`
oracle	communications_cloud_native_core_policy	22.2.0	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[oss-security] 20210914 Disclosure: CVE-2021-3744: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() mailing-list
cve.org

访问

FEDORA-2021-79cbbefebe vendor-advisory
cve.org

访问

FEDORA-2021-ffda3d6fa1 vendor-advisory
cve.org

访问

FEDORA-2021-9dd76a1ed0 vendor-advisory
cve.org

访问