CVE-2021-41375
published 2021-11-10CVE-2021-41375: Azure Sphere Information Disclosure Vulnerability Azure Sphere Information Disclosure Vulnerability
medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.80%
52.1th percentile
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | azure_sphere | >= 20.00 < 22.07 | 22.07 |
| msrc | azure_sphere | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
cvelistv54.4MEDIUM
vendor_msrc4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-385x-88c3-c379: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41375, CVE-2021-41376
ghsa_unreviewed·2022-05-24·CVSS 4.4
CVE-2021-41374 [MEDIUM] GHSA-385x-88c3-c379: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41375, CVE-2021-41376
Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41375, CVE-2021-41376.
GHSA
GHSA-q954-f5ff-wjpj: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41374, CVE-2021-41375
ghsa_unreviewed·2022-05-24·CVSS 6.7
CVE-2021-41376 [MEDIUM] GHSA-q954-f5ff-wjpj: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41374, CVE-2021-41375
Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41374, CVE-2021-41375.
GHSA
GHSA-v5pc-3qp7-8qqj: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41374, CVE-2021-41376
ghsa_unreviewed·2022-05-24·CVSS 6.7
CVE-2021-41375 [MEDIUM] GHSA-v5pc-3qp7-8qqj: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41374, CVE-2021-41376
Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-41374, CVE-2021-41376.
CVEList
Azure Sphere Information Disclosure Vulnerability
cvelistv5·2021-11-10·CVSS 4.4
CVE-2021-41375 [MEDIUM] Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Microsoft
Azure Sphere Information Disclosure Vulnerability
vendor_msrc·2021-11-09·CVSS 4.4
CVE-2021-41375 [MEDIUM] Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
FAQ: What version of Azure Sphere has the update that protects from this vulnerability?
All versions of Azure Sphere that are 21.10 and higher are protected from this vulnerability.
How do I ensure my Azure Sphere device has the update?
If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.10 has been installed using the Azure Sphere CLI command:
azsphere device show-os-version
If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere
No detection rules found.
No public exploits indexed.
Talos
Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton
blogs_talos·2021-11-09·CVSS 6.7
[MEDIUM] Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton
By Claudio Bozzato and Lilith [-_-];.
Following our previous engagements (see blog posts 1, 2, 3 and 4) with Microsoft's Azure Sphere IoT platform, we decided to take another look at the device, without all the rush and commotion that normally entails a hacking challenge.
Today, we’re disclosing another 10 vulnerabilities in Azure Sphere — two of which are on the Linux side, seven that exist in Security Monitor and one in the Pluton security subsystem.
As opposed to our previous architectural overview, this post will simply walk through the vulnerabilities we discovered as part of our continued research into Azure Sphere, starting with the Linux kernel side.
## Kernel information disclosure
Microsoft Azure Sphere Kernel GPIO_SET_PIN_CONFIG_IOCTL information disclosure vulnerability (T
Talos
Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton
blogs_talos·2021-11-09·CVSS 6.7
[MEDIUM] Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton
## Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton
By Claudio Bozzato and Lilith [-_-];.
Following our previous engagements (see blog posts 1 , 2 , 3 and 4 ) with Microsoft's Azure Sphere IoT platform, we decided to take another look at the device, without all the rush and commotion that normally entails a hacking challenge.
Today, we’re disclosing another 10 vulnerabilities in Azure Sphere — two of which are on the Linux side, seven that exist in Security Monitor and one in the Pluton security subsystem.
As opposed to our previous architectural overview , this post will simply walk through the vulnerabilities we discovered as part of our continued research into Azure Sphere, starting with the Linux kernel side.
## Kernel information di
2021-11-10
Published