CVE-2021-1996 — Out-of-bounds Read in Oracle

Vendor	Product	Version range	Fixed in
oracle	agile_engineering_data_management	—	—
oracle	hyperion_infrastructure_technology	—	—
oracle	siebel_ui_framework	<= 20.12	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

GHSA

GHSA-c2jc-w78x-gvc4: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services)

ghsa_unreviewed·2022-05-24

CVE-2021-1996 [LOW] GHSA-c2jc-w78x-gvc4: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services) Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).

Red Hat

kernel: video: fbdev: cirrusfb: check pixclock to avoid divide by zero

vendor_redhat·2025-02-26·CVSS 5.5

CVE-2021-47641 [MEDIUM] CWE-369 kernel: video: fbdev: cirrusfb: check pixclock to avoid divide by zero kernel: video: fbdev: cirrusfb: check pixclock to avoid divide by zero In the Linux kernel, the following vulnerability has been resolved: video: fbdev: cirrusfb: check pixclock to avoid divide by zero Do a sanity check on pixclock value to avoid divide by zero. If the pixclock value is zero, the cirrusfb driver will round up pixclock to get the derived frequency as close to maxclock as possible. Syzkaller reported a divide error in cirrusfb_check_pixclock. divide error: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2 RIP: 0010:cirrusfb_check_var+0x6f1/0x1260 Call Trace: fb_set_var+0x398/0xf90 do_fb_ioctl+0x4b8/0x6f0 fb_ioctl+0xeb/0x130 __x64_sys_ioctl+0x19d/0x220 do_syscall_64+0x3

Red Hat

kernel: nfc: fix segfault in nfc_genl_dump_devices_done

vendor_redhat·2024-06-19·CVSS 5.5

CVE-2021-47612 [MEDIUM] CWE-476 kernel: nfc: fix segfault in nfc_genl_dump_devices_done kernel: nfc: fix segfault in nfc_genl_dump_devices_done In the Linux kernel, the following vulnerability has been resolved: nfc: fix segfault in nfc_genl_dump_devices_done When kmalloc in nfc_genl_dump_devices() fails then nfc_genl_dump_devices_done() segfaults as below KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:klist_iter_exit+0x26/0x80 Call Trace: class_dev_iter_exit+0x15/0x20 nfc_genl_dump_devices_done+0x3b/0x50 genl_lock_done+0x84/0xd0 netlink_sock_destruct+0x8f/0x270 __sk_destruct+0x64/0x3b0 sk_destruct+0xa8/0xd0 __sk_free+0x2e8/0x3d0

Red Hat

kernel: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()

vendor_redhat·2024-06-19·CVSS 7.8

CVE-2021-47576 [HIGH] CWE-416 kernel: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() kernel: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Call Trace: dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443 __asan_report_load1_noabort+0x14/0x2

Red Hat

kernel: can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible()

vendor_redhat·2024-05-22·CVSS 5.5

CVE-2021-47457 [MEDIUM] CWE-99 kernel: can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() kernel: can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() In the Linux kernel, the following vulnerability has been resolved: can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() Using wait_event_interruptible() to wait for complete transmission, but do not check the result of wait_event_interruptible() which can be interrupted. It will result in TX buffer has multiple accessors and the later process interferes with the previous process. Following is one of the problems reported by syzbot. WARNING: CPU: 0 PID: 0 at net/can/isotp.c:840 isotp_tx_timer_handler+0x2e0/0x4c0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc7+ #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:isotp_tx_timer_ha

Red Hat

kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()

vendor_redhat·2024-03-04·CVSS 5.5

CVE-2021-47090 [MEDIUM] CWE-20 kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() In the Linux kernel, the following vulnerability has been resolved: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() Hulk Robot reported a panic in put_page_testzero() when testing madvise() with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying get_any_page(). This is because we keep MF_COUNT_INCREASED flag in second try but the refcnt is not increased. page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:737! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: releas

Red Hat

kernel: RDMA/core: Prevent divide-by-zero error triggered by the user

vendor_redhat·2024-03-01·CVSS 5.5

CVE-2021-47080 [MEDIUM] CWE-369 kernel: RDMA/core: Prevent divide-by-zero error triggered by the user kernel: RDMA/core: Prevent divide-by-zero error triggered by the user In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prevent divide-by-zero error triggered by the user The user_entry_size is supplied by the user and later used as a denominator to calculate number of entries. The zero supplied by the user will trigger the following divide-by-zero error: divide error: 0000 [#1] SMP KASAN PTI CPU: 4 PID: 497 Comm: c_repro Not tainted 5.13.0-rc1+ #281 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE+0x1b1/0x510 Code: 87 59 03 00 00 e8 9f ab 1e ff 48 8d bd a8 00 00 00 e8 d3 70 41 ff 44 0f b7 b5 a8 00 00 00 e8 86 ab 1e ff 31 d2 4c 89 f0 31

Red Hat

kernel: f2fs: compress: fix race condition of overwrite vs truncate

vendor_redhat·2024-02-28·CVSS 4.7

CVE-2021-46982 [MEDIUM] CWE-362 kernel: f2fs: compress: fix race condition of overwrite vs truncate kernel: f2fs: compress: fix race condition of overwrite vs truncate In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix race condition of overwrite vs truncate pos_fsstress testcase complains a panic as belew: ------------[ cut here ]------------ kernel BUG at fs/f2fs/compress.c:1082! invalid opcode: 0000 [#1] SMP PTI CPU: 4 PID: 2753477 Comm: kworker/u16:2 Tainted: G OE 5.12.0-rc1-custom #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: writeback wb_workfn (flush-252:16) RIP: 0010:prepare_compress_overwrite+0x4c0/0x760 [f2fs] Call Trace: f2fs_prepare_compress_overwrite+0x5f/0x80 [f2fs] f2fs_write_cache_pages+0x468/0x8a0 [f2fs] f2fs_write_data_pages+0x2a4/0x2f0 [f2fs] do_writepages+0x38/0xc0 __writeback_single

Oracle

Oracle Oracle Fusion Middleware Risk Matrix: Web Services — CVE-2021-1996

vendor_oracle·2021-01-15·CVSS 2.4

CVE-2021-1996 [LOW] Oracle Oracle Fusion Middleware Risk Matrix: Web Services — CVE-2021-1996 Oracle Oracle Fusion Middleware Risk Matrix: Web Services vulnerability CVE: CVE-2021-1996 CVSS: 2.4 Protocol: HTTP Remote exploit: No Affected versions: Network Advisory: cpujan2021 (JAN 2021)

CVE-2021-1996: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0…

Affected

CVSS provenance