CVE-2021-27364
published 2021-03-07CVE-2021-27364: An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to…
PriorityP430high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.97%
61.3th percentile
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.10.24-1 (bookworm) | linux 5.10.24-1 (bookworm) |
| linux | linux_kernel | < 4.4.260 | 4.4.260 |
| linux | linux_kernel | >= 0 < 5.10.24-1 | 5.10.24-1 |
| linux | linux_kernel | >= 0 < 5.10.24-1 | 5.10.24-1 |
| linux | linux_kernel | >= 0 < 5.10.24-1 | 5.10.24-1 |
| linux | linux_kernel | >= 0 < 5.10.24-1 | 5.10.24-1 |
| linux | linux_kernel | >= 0 < 4.4.0-206.238 | 4.4.0-206.238 |
| linux | linux_kernel | >= 0 < 4.15.0-139.143 | 4.15.0-139.143 |
| linux | linux_kernel | >= 0 < 5.4.0-70.78 | 5.4.0-70.78 |
| linux | linux_kernel | >= 0 < 3.13.0-185.236 | 3.13.0-185.236 |
| linux | linux_kernel | >= 4.10 < 4.14.224 | 4.14.224 |
| linux | linux_kernel | >= 4.15 < 4.19.179 | 4.19.179 |
| linux | linux_kernel | >= 4.20 < 5.4.103 | 5.4.103 |
| linux | linux_kernel | >= 4.5 < 4.9.260 | 4.9.260 |
| linux | linux_kernel | >= 5.11 < 5.11.4 | 5.11.4 |
| linux | linux_kernel | >= 5.5 < 5.10.21 | 5.10.21 |
| msrc | cbl2_kernel_5.10.78.1-1_on_cbl_mariner_2.0 | — | — |
| oracle | tekelec_platform_distribution | 7.4.0 – 7.7.1 | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:N/A:P
osv7.1HIGH
vendor_ubuntu8.1HIGH
vendor_debian7.1HIGH
vendor_msrc7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2021-04-06·CVSS 8.1
CVE-2021-27365 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-27365)
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data. (CVE-2020-28374)
Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did
not properly restrict access to iSCSI transport handles. A local attacker
co
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-03-29·CVSS 4.4
CVE-2021-27365 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-27365)
Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did
not properly restrict access to iSCSI transport handles. A local attacker
could use this to cause a denial of service or expose sensitive information
(kernel pointer addresses). (CVE-2021-27363)
Adam Nichols discovered that an out-of-bounds read existed in the iSCSI
subsystem in the Linux kernel. A local attacker could use this to cause a
denial of service (system crash) or expose sensitive inf
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-03-25·CVSS 4.4
CVE-2021-27363 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-27365)
Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did
not properly restrict access to iSCSI transport handles. A local attacker
could use this to cause a denial of service or expose sensitive information
(kernel pointer addresses). (CVE-2021-27363)
Adam Nichols discovered that an out-of-bounds read existed in the iSCSI
subsystem in the Linux kernel. A local attacker could use this to cause a
denial of service (system crash) or expose sensitive inf
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-03-23·CVSS 4.7
CVE-2020-27170 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
De4dCr0w of 360 Alpha Lab discovered that the BPF verifier in the Linux
kernel did not properly handle mod32 destination register truncation when
the source register was known to be 0. A local attacker could use this to
expose sensitive information (kernel memory) or possibly execute arbitrary
code. (CVE-2021-3444)
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-27365)
Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not
properly compute a speculative execution limit on pointer arithmetic in
some
Microsoft
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
vendor_msrc·2021-03-09·CVSS 7.1
CVE-2021-27364 [HIGH] CWE-125 An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect t
Red Hat
kernel: out-of-bounds read in libiscsi module
vendor_redhat·2021-03-05·CVSS 7.1
CVE-2021-27364 [HIGH] CWE-125 kernel: out-of-bounds read in libiscsi module
kernel: out-of-bounds read in libiscsi module
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
A flaw was found in the Linux kernel. An out-of-bounds read was discovered in the libiscsi module that could lead to reading kernel memory or a crash. The highest threat from this vulnerability is to data confidentiality as well as system availability.
Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available.
Mitigation: The LIBISCSI module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:
# echo "install libiscsi /bin/true" >> /
Debian
CVE-2021-27364: linux - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_tr...
vendor_debian·2021·CVSS 7.1
CVE-2021-27364 [HIGH] CVE-2021-27364: linux - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_tr...
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
Scope: local
bookworm: resolved (fixed in 5.10.24-1)
bullseye: resolved (fixed in 5.10.24-1)
forky: resolved (fixed in 5.10.24-1)
sid: resolved (fixed in 5.10.24-1)
trixie: resolved (fixed in 5.10.24-1)
VulDB
Linux Kernel up to 5.11.3 Netlink Message scsi_transport_iscsi.c iscsi_if_recv_msg out-of-bounds
vuldb·2026-07-30·CVSS 7.1
CVE-2021-27364 [HIGH] Linux Kernel up to 5.11.3 Netlink Message scsi_transport_iscsi.c iscsi_if_recv_msg out-of-bounds
A vulnerability was found in Linux Kernel up to 5.11.3. It has been declared as problematic. Affected by this issue is the function iscsi_if_recv_msg of the file drivers/scsi/scsi_transport_iscsi.c of the component Netlink Message Handler. The manipulation results in out-of-bounds read.
This vulnerability is known as CVE-2021-27364. Access to the local network is required for this attack. No exploit is available.
It is advisable to implement a patch to correct this issue.
GHSA
GHSA-qh7p-rxx9-vwx2: An issue was discovered in the Linux kernel through 5
ghsa_unreviewed·2022-05-24
CVE-2021-27364 [HIGH] CWE-125 GHSA-qh7p-rxx9-vwx2: An issue was discovered in the Linux kernel through 5
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2021-03-29·CVSS 4.4
CVE-2021-27365 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-27365)
Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did
not properly restrict access to iSCSI transport handles. A local attacker
could use this to cause a denial of service or expose sensitive information
(kernel pointer addresses). (CVE-2021-27363)
Adam Nichols discovered that an out-of-bounds read existed in the iSCSI
subsystem in the Linux kernel. A local attacker could use
OSV
linux, linux-lts-xenial vulnerabilities
osv·2021-03-25·CVSS 4.4
CVE-2021-27365 [MEDIUM] linux, linux-lts-xenial vulnerabilities
linux, linux-lts-xenial vulnerabilities
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-27365)
Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did
not properly restrict access to iSCSI transport handles. A local attacker
could use this to cause a denial of service or expose sensitive information
(kernel pointer addresses). (CVE-2021-27363)
Adam Nichols discovered that an out-of-bounds read existed in the iSCSI
subsystem in the Linux kernel. A local attacker could use this to cause a
denial of service (system crash) or expose sensitive information (kernel
memory). (CVE-2021-27364)
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm,
osv·2021-03-23·CVSS 4.7
[MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm,
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.3, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-kvm, linux-oem-5.10, linux-oem-5.6, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-raspi2-5.3 vulnerabilities
De4dCr0w of 360 Alpha Lab discovered that the BPF verifier in the Linux
kernel did not properly handle mod32 destination register truncation when
the source register was known to be 0. A local attacker could use this to
expose sensitive information (kernel memory) or possibly execute arbitrary
code. (CVE-2021-3444)
Adam Nichols discovered that heap overflows existed in the iSCSI subsystem
in the Linux kernel. A local attacker could use this to cause a denial of
servi
OSV
CVE-2021-27364: An issue was discovered in the Linux kernel through 5
osv·2021-03-07·CVSS 7.1
CVE-2021-27364 [HIGH] CVE-2021-27364: An issue was discovered in the Linux kernel through 5
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlhttps://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.htmlhttps://bugzilla.suse.com/show_bug.cgi?id=1182717https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aahttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlhttps://security.netapp.com/advisory/ntap-20210409-0001/https://www.openwall.com/lists/oss-security/2021/03/06/1https://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlhttps://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.htmlhttps://bugzilla.suse.com/show_bug.cgi?id=1182717https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aahttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlhttps://security.netapp.com/advisory/ntap-20210409-0001/https://www.openwall.com/lists/oss-security/2021/03/06/1https://www.oracle.com/security-alerts/cpuoct2021.html
2021-03-07
Published