CVE-2021-0001
published 2021-06-09CVE-2021-0001: Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via local…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.21%
11.1th percentile
Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via local access.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| intel | integrated_performance_primitives_cryptography | — | — |
| intel | integrated_performance_primitives_cryptography | — | — |
| intel | optimization_for_tensorflow | >= 0 < 2.1.4 | 2.1.4 |
| intel | optimization_for_tensorflow | >= 2.2.0 < 2.2.3 | 2.2.3 |
| intel | optimization_for_tensorflow | >= 2.3.0 < 2.3.3 | 2.3.3 |
| intel | optimization_for_tensorflow | >= 2.4.0 < 2.4.2 | 2.4.2 |
| intel | sgx_dcap | <= 1.10.100.4 | — |
| intel | sgx_psw | <= 2.12.100.4 | — |
| intel | sgx_psw | <= 2.13.100.4 | — |
| intel | sgx_sdk | <= 2.12.100.4 | — |
| intel | sgx_sdk | <= 2.13.100.4 | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-azure vulnerabilities
osv·2024-07-10·CVSS 7.8
CVE-2021-33631 linux-azure vulnerabilities
linux-azure vulnerabilities
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly validate data state on write operations. An
attacker could use this to construct a malicious ext4 file system image
that, when mounted, could cause a denial of service (system crash).
(CVE-2021-33631)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2023-6270)
Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida
discovered that the Linux kernel mitigations for the initial Branch History
Injection vulnerability (CVE-2022-0001) were insufficient for I
OSV
linux-azure, linux-azure-4.15 vulnerabilities
osv·2024-07-04·CVSS 7.8
CVE-2021-33631 linux-azure, linux-azure-4.15 vulnerabilities
linux-azure, linux-azure-4.15 vulnerabilities
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly validate data state on write operations. An
attacker could use this to construct a malicious ext4 file system image
that, when mounted, could cause a denial of service (system crash).
(CVE-2021-33631)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2023-6270)
Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida
discovered that the Linux kernel mitigations for the initial Branch History
Injection vulnerability (CVE-2022-0001) were
GHSA
GHSA-78jj-chhm-hm82: Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via
ghsa_unreviewed·2022-05-24
CVE-2021-0001 [MEDIUM] CWE-203 GHSA-78jj-chhm-hm82: Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via
Observable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized user to potentially enable information disclosure via local access.
GHSA
Division by 0 in `QuantizedConv2D`
ghsa·2021-05-21
CVE-2021-29527 [LOW] CWE-369 Division by 0 in `QuantizedConv2D`
Division by 0 in `QuantizedConv2D`
### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedConv2D`:
```python
import tensorflow as tf
input = tf.zeros([1, 1, 1, 1], dtype=tf.quint8)
filter = tf.constant([], shape=[1, 0, 1, 1], dtype=tf.quint8)
min_input = tf.constant(0.0)
max_input = tf.constant(0.0001)
min_filter = tf.constant(0.0)
max_filter = tf.constant(0.0001)
strides = [1, 1, 1, 1]
padding = "SAME"
tf.raw_ops.QuantizedConv2D(input=input, filter=filter, min_input=min_input, max_input=max_input, min_filter=min_filter, max_filter=max_filter, strides=strides, padding=padding)
```
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/00e9a4d67d76703fa1aee33dac582acf317e0e81/tensorflow/core/kernels/quantized_conv_ops.cc#L257-L259) does a
VMware
VMware Workstation, Fusion and ESXi updates address a heap-overflow vulnerability (CVE-2021-22045)
vendor_vmware·2022-01-04·CVSS 7.8
CVE-2021-22045 [HIGH] VMware Workstation, Fusion and ESXi updates address a heap-overflow vulnerability (CVE-2021-22045)
VMSA-2022-0001: VMware Workstation, Fusion and ESXi updates address a heap-overflow vulnerability (CVE-2021-22045)
The CD-ROM device emulation in VMware Workstation, Fusion and ESXi has a heap-overflow vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.7.
CVEs: CVE-2021-22045
Affected products: VMware Cloud Foundation, VMware ESXi, VMware Fusion, VMware Workstation, VMware vSphere, Workstation Player, Workstation Pro
VMware
vSphere Replication updates address a command injection vulnerability (CVE-2021-21976)
vendor_vmware·2021-02-11·CVSS 7.2
CVE-2021-21976 [HIGH] vSphere Replication updates address a command injection vulnerability (CVE-2021-21976)
VMSA-2021-0001: vSphere Replication updates address a command injection vulnerability (CVE-2021-21976)
vSphere Replication contains a post-authentication command injection vulnerability in "Startup Configuration" page. VMware has evaluated this issue to be 'Important' severity with a maximum CVSSv3 base score of 7.2.
CVEs: CVE-2021-21976
Affected products: ESXi, VMware vSphere
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-09
Published