CVE-2021-1993
published 2021-01-20CVE-2021-1993: Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to…
PriorityP423medium4.8CVSS 3.1
AVNACHPRLUIRSUCNIHAN
EPSS
0.81%
52.8th percentile
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 4.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | hyperion_infrastructure_technology | — | — |
| oracle | zfs_storage_appliance | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
| oracle_corporation | database_enterprise_edition | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:N/I:P/A:N
vendor_oracle4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2mj9-chm4-g5pj: Vulnerability in the Java VM component of Oracle Database Server
ghsa_unreviewed·2022-05-24
CVE-2021-1993 [MEDIUM] GHSA-2mj9-chm4-g5pj: Vulnerability in the Java VM component of Oracle Database Server
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 4.8 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).
Kernel
Merge tag 'xfs-5.17-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
kernel_security·2022-01-21
Merge tag 'xfs-5.17-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Merge tag 'xfs-5.17-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs irix ioctl housecleaning from Darrick Wong:
"Remove the XFS_IOC_ALLOCSP* and XFS_IOC_FREESP* ioctl families.
This is the second of a series of small pull requests that perform
some long overdue housecleaning of XFS ioctls. This time, we're
vacating the implementation of all variants of the ALLOCSP and FREESP
ioctls, which are holdovers from EFS in Irix, circa 1993. Roughly
equivalent functionality have been available for both ioctls since
2.6.25 (April 2008):
- XFS_IOC_FREESP ftruncates a file.
- XFS_IOC_ALLOCSP is the equivalent of fallocate.
As noted in the fix patch for CVE 2021-4155, the ALLOCSP ioctl has
been serving up stale disk blocks since 2000, and in 21 years
**nobody** noticed. On those
Kernel
xfs: kill the XFS_IOC_{ALLOC,FREE}SP* ioctls
kernel_security·2022-01-07·CVSS 5.5
CVE-2021-4155 [MEDIUM] xfs: kill the XFS_IOC_{ALLOC,FREE}SP* ioctls
xfs: kill the XFS_IOC_{ALLOC,FREE}SP* ioctls
According to the glibc compat header for Irix 4, these ioctls originated
in April 1991 as a (somewhat clunky) way to preallocate space at the end
of a file on an EFS filesystem. XFS, which was released in Irix 5.3 in
December 1993, picked up these ioctls to maintain compatibility and they
were ported to Linux in the early 2000s.
Recently it was pointed out to me they still lurk in the kernel, even
though the Linux fallocate syscall supplanted the functionality a long
time ago. fstests doesn't seem to include any real functional or stress
tests for these ioctls, which means that the code quality is ... very
questionable. Most notably, it was a stale disk block exposure vector
for 21 years and nobody noticed or complained. As mature programmers
Oracle
Oracle Oracle Database Server Risk Matrix: Java VM — CVE-2021-1993
vendor_oracle·2021-01-15·CVSS 4.8
CVE-2021-1993 [MEDIUM] Oracle Oracle Database Server Risk Matrix: Java VM — CVE-2021-1993
Oracle Oracle Database Server Risk Matrix: Java VM vulnerability
CVE: CVE-2021-1993
CVSS: 4.8
Protocol: Oracle Net
Remote exploit: No
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-20
Published