CVE-2021-20320 — Sensitive Information Exposure in Kernel

CWE-200 — Sensitive Information Exposure7 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 73.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelFedoraproject FedoraRedhat Enterprise Linux
Timeline
PublishedFeb 18
Latest updateFeb 19

Description

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDlinux/linux_kernel< 5.15+1
▶Debianlinux/linux_kernel< 5.10.70-1+3
▶CVEListV5linux/linux_kernelkernel 5.15 rc3

Also affects: Enterprise Linux 7.0, 8.0, Fedora 34

🔴Vulnerability Details

3
GHSA
GHSA-9q69-f33x-263w: A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp↗2022-02-19
▶
OSV
CVE-2021-20320: A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp↗2022-02-18
▶
CVEList
CVE-2021-20320: A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp↗2022-02-18
▶

📋Vendor Advisories

3
Microsoft
A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw a local attacker with special user privilege can circumvent the verifier and may lea↗2022-02-08
▶
Red Hat
kernel: s390 eBPF JIT miscompilation issues fixes↗2021-09-06
▶
Debian
CVE-2021-20320: linux - A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp....↗2021
▶
CVE-2021-20320 — Sensitive Information Exposure | cvebase