CVE-2021-22995
published 2021-03-31CVE-2021-22995: On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.87%
54.7th percentile
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-iq | — | — |
| f5 | big-iq_centralized_management | — | — |
| f5 | big-iq_centralized_management | 6.0.0 – 6.1.0 | — |
| f5 | big-iq_centralized_management | 7.0.0 – 7.1.0 | — |
| linux | linux_kernel | >= 0 < 5.4.0-173.191 | 5.4.0-173.191 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2021-22995: On all 7
vendor_f5·2021-03-31·CVSS 7.5
CVE-2021-22995 [HIGH] CWE-306 CVE-2021-22995: On all 7
CVE-2021-22995: On all 7
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected Products: BIG-IQ
Affected Versions: 6.0.0 - 6.1.0; 7.0.0 - 7.1.0
F5 Advisory Articles: K13155201
F5 References: https://support.f5.com/csp/article/K13155201
OSV
linux-azure, linux-azure-5.4 vulnerabilities
osv·2024-03-25·CVSS 5.5
CVE-2021-44879 linux-azure, linux-azure-5.4 vulnerabilities
linux-azure, linux-azure-5.4 vulnerabilities
Wenqing Liu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate inode types while performing garbage
collection. An attacker could use this to construct a malicious f2fs image
that, when mounted and operated on, could cause a denial of service (system
crash). (CVE-2021-44879)
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
It was discovered that the NVIDIA Tegra XUSB pad controller driver in the
Linux kernel did not properly handle return values in certain error
conditions. A local
OSV
linux-aws, linux-aws-5.4 vulnerabilities
osv·2024-03-19·CVSS 5.5
CVE-2021-44879 linux-aws, linux-aws-5.4 vulnerabilities
linux-aws, linux-aws-5.4 vulnerabilities
Wenqing Liu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate inode types while performing garbage
collection. An attacker could use this to construct a malicious f2fs image
that, when mounted and operated on, could cause a denial of service (system
crash). (CVE-2021-44879)
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local user could use th
OSV
linux-ibm, linux-ibm-5.4, linux-oracle, linux-oracle-5.4 vulnerabilities
osv·2024-03-13·CVSS 5.5
CVE-2021-44879 linux-ibm, linux-ibm-5.4, linux-oracle, linux-oracle-5.4 vulnerabilities
linux-ibm, linux-ibm-5.4, linux-oracle, linux-oracle-5.4 vulnerabilities
Wenqing Liu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate inode types while performing garbage
collection. An attacker could use this to construct a malicious f2fs image
that, when mounted and operated on, could cause a denial of service (system
crash). (CVE-2021-44879)
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition, leading to a use-after-free vulnerab
OSV
linux-bluefield, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities
osv·2024-03-11·CVSS 5.5
CVE-2021-44879 linux-bluefield, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities
linux-bluefield, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities
Wenqing Liu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate inode types while performing garbage
collection. An attacker could use this to construct a malicious f2fs image
that, when mounted and operated on, could cause a denial of service (system
crash). (CVE-2021-44879)
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition, leading to a use-after-free vulnerabili
OSV
linux, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-iot, linux-kvm, linux-raspi vulnerabilities
osv·2024-03-06·CVSS 5.5
CVE-2021-44879 linux, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-iot, linux-kvm, linux-raspi vulnerabilities
linux, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-iot, linux-kvm, linux-raspi vulnerabilities
Wenqing Liu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate inode types while performing garbage
collection. An attacker could use this to construct a malicious f2fs image
that, when mounted and operated on, could cause a denial of service (system
crash). (CVE-2021-44879)
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition
GHSA
GHSA-f9gc-34jh-7gvq: On all 7
ghsa_unreviewed·2022-05-24
CVE-2021-22995 [HIGH] CWE-306 GHSA-f9gc-34jh-7gvq: On all 7
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-31
Published