CVE-2021-26392
published 2022-11-09CVE-2021-26392: Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain…
PriorityP343high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.5th percentile
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| amd | amd_radeon_rx_5000_series_pro_w5000_series | >= AMD Radeon Pro Software Enterprise < 22.Q2 | 22.Q2 |
| amd | amd_radeon_rx_5000_series_pro_w5000_series | >= AMD Radeon Software < 22.5.2 | 22.5.2 |
| amd | amd_radeon_rx_5000_series_pro_w5000_series | >= Enterprise Driver < 22.10.20 | 22.10.20 |
| amd | amd_radeon_rx_6000_series_pro_w6000_series | >= AMD Radeon Pro Software Enterprise < 22.Q2 | 22.Q2 |
| amd | amd_radeon_rx_6000_series_pro_w6000_series | >= AMD Radeon Software < 22.5.2 | 22.5.2 |
| amd | amd_radeon_rx_6000_series_pro_w6000_series | >= Enterprise Driver < 22.10.20 | 22.10.20 |
| amd | amd_ryzen_embedded_5000 | — | — |
| amd | amd_ryzen_embedded_r1000 | — | — |
| amd | amd_ryzen_embedded_r2000 | — | — |
| amd | amd_ryzen_embedded_v1000 | — | — |
| amd | amd_ryzen_embedded_v2000 | — | — |
| amd | amd_ryzen_embedded_v3000 | — | — |
| amd | enterprise_driver | < 22.10.20 | 22.10.20 |
| amd | radeon_pro_software | < 22.q2 | 22.q2 |
| amd | radeon_software | < 22.5.2 | 22.5.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-494r-cmj8-94j9: Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to
ghsa_unreviewed·2022-11-10
CVE-2021-26392 [HIGH] CWE-787 GHSA-494r-cmj8-94j9: Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.
Red Hat
hw: amd: Insufficient verification in 'LoadModule' may lead to an out-of-bounds write
vendor_redhat·2022-11-08·CVSS 7.8
CVE-2021-26392 [HIGH] CWE-787 hw: amd: Insufficient verification in 'LoadModule' may lead to an out-of-bounds write
hw: amd: Insufficient verification in 'LoadModule' may lead to an out-of-bounds write
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.
A flaw was found in hw. Insufficient verification of missing size checks in the 'LoadModule' may lead to an out-of-bounds write, potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious Trusted Application (TA).
Mitigation: Please contact AMD for more updates on this flaw.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-09
Published