CVE-2021-0961 — Missing Initialization of Resource in Google Android

CWE-909 — Missing Initialization of ResourceCWE-665 — Improper Initialization8 documents7 sources
Severity
4.4MEDIUMNVD
EPSS
0.0%
top 85.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian LinuxGoogle Android
Timeline
PublishedDec 15
Latest updateMar 14

Description

In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196046570References: Upstream kernel

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/linux

🔴Vulnerability Details

3
GHSA
GHSA-9mr6-2c2v-735f: In quota_proc_write of xt_quota2↗2021-12-16
▶
OSV
CVE-2021-0961: In quota_proc_write of xt_quota2↗2021-12-15
▶
OSV
CVE-2021-0961: In quota_proc_write of xt_quota2↗2021-12-01
▶

📋Vendor Advisories

4
CISA ICS
Siemens SIMATIC↗2024-03-14
▶
Red Hat
kernel: there is a possible way to read kernel memory due to uninitialized data in quota_proc_write() in xt_quota2.c↗2021-12-06
▶
Android
CVE-2021-0961: netfilter↗2021-12-01
▶
Debian
CVE-2021-0961: linux - In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memor...↗2021
▶
CVE-2021-0961 — Missing Initialization of Resource | cvebase