CVE-2021-3736 — Sensitive Information Exposure in Linux

CWE-200 — Sensitive Information ExposureCWE-401 — Missing Release of Memory after Effective Lifetime6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 83.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelDebian LinuxMsrc CM1 Kernel 5.10.134.1-2 ON CBL Mariner 1.0
Timeline
PublishedAug 23
Latest updateAug 24

Description

A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶Debianlinux/linux_kernel< 5.14.6-1+2
▶NVDlinux/linux_kernel5.14.20
▶CVEListV5linux/linux_kernelFixed in v5.15-rc1
▶debiandebian/linux< linux 5.14.6-1 (bookworm)

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-c24j-22f8-p2wg: A flaw was found in the Linux kernel↗2022-08-24
▶
OSV
CVE-2021-3736: A flaw was found in the Linux kernel↗2022-08-23
▶

📋Vendor Advisories

3
Microsoft
A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attac↗2022-08-09
▶
Red Hat
kernel: uninitialized kernel stack may lead to information disclosure↗2021-11-03
▶
Debian
CVE-2021-3736: linux - A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_...↗2021
▶