CVE-2021-4037 — Improper Access Control in Linux Kernel

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	linux	< linux 5.14.6-1 (bookworm)	linux 5.14.6-1 (bookworm)
linux	linux_kernel	< 5.11	5.11
linux	linux_kernel	>= 0 < 5.10.149-1	5.10.149-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 4.4.0-234.268	4.4.0-234.268
msrc	cm1_kernel_5.10.155.1-1_on_cbl_mariner_1.0	—	—

OSV

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities

osv·2022-09-30·CVSS 6.7

CVE-2021-33655 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655) It was discovered that the virtual terminal driver in the Linux kernel did not properly handle VGA console font changes, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33656) Christian Brauner discovered that the XFS file system implementation in the Linux kernel did not properly handle setgid file creation. A local attacker could

GHSA

GHSA-gvgr-4fph-m6hc: A vulnerability was found in the fs/inode

ghsa_unreviewed·2022-08-25·CVSS 7.8

CVE-2021-4037 [HIGH] CWE-284 GHSA-gvgr-4fph-m6hc: A vulnerability was found in the fs/inode A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

OSV

CVE-2021-4037: A vulnerability was found in the fs/inode

osv·2022-08-24·CVSS 7.8

CVE-2021-4037 [HIGH] CVE-2021-4037: A vulnerability was found in the fs/inode A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

CISA ICS

Siemens SCALANCE XCM-/XRM-300

cisa_ics·2024-02-15

Siemens SCALANCE XCM-/XRM-300 ICS Advisory ## Siemens SCALANCE XCM-/XRM-300 Release DateFebruary 15, 2024 Alert CodeICSA-24-046-11 As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF ## 1. EXECUTIVE SUMMARY - CVSS v3 9.8 - ATTENTION: Exploitable remotely/low attack complexity - Vendor: Siemens - Equipment: SCALANCE XCM-/XRM-300 - Vulnerabilities: Out-of-bounds Write, Incorrect Type Conversion or Cast, Improper Verification of Cryptographic Signature, Improper Access Control, Improper Authentication, Missing Encryption

CISA ICS

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

cisa_ics·2023-06-15·CVSS 5.5

[MEDIUM] Siemens SIMATIC S7-1500 TM MFP Linux Kernel ICS Advisory ## Siemens SIMATIC S7-1500 TM MFP Linux Kernel Release DateJune 15, 2023 Alert CodeICSA-23-166-11 ## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). ## 1. EXECUTIVE SUMMARY - CVSS v3 9.8 - ATTENTION: Exploitable remotely / low attack complexity / public exploits available - Vendor: Siemens ProductCERT - Equipment: SIMATIC S7-1500 TM MFP - Vulnerabilities: Multiple vulnerabilities ## 2. RISK EVALUATION Exploitation of these vulnerabilities could lead to denial-of-service, crashing t

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2022-09-30·CVSS 6.7

CVE-2021-4037 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655) It was discovered that the virtual terminal driver in the Linux kernel did not properly handle VGA console font changes, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33656) Christian Brauner discovered that the XFS file system implementation in the Linux kernel did not properly handle setg

Microsoft

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and

vendor_msrc·2022-08-09·CVSS 7.8

CVE-2021-4037 [HIGH] CWE-284 A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the comm

Red Hat

kernel: security regression for CVE-2018-13405

vendor_redhat·2021-09-16·CVSS 7.8

CVE-2021-4037 [HIGH] CWE-284 kernel: security regression for CVE-2018-13405 kernel: security regression for CVE-2018-13405 A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group owner

Debian

CVE-2021-4037: linux - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of...

vendor_debian·2021·CVSS 7.8

CVE-2021-4037 [HIGH] CVE-2021-4037: linux - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of... A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.149-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixed in 5.14.6-1)

CVE-2021-4037: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS…

Affected

CVSS provenance