CVE-2021-38160
High
Description
In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior
SeverityHigh
CVSS7.8
Exploit probability—
Product
Linux Kernel
PublishedAug 7, 2021
First seenAug 7, 2021
How to fix
Update
- linux linux_kernel4.4.276, 4.9.276, 4.14.240, 4.19.198, 5.4.134, 5.10.52, 5.12.19, 5.13.4 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.24 ≤ v < 4.4.276, 4.5 ≤ v < 4.9.276, 4.10 ≤ v < 4.14.240, 4.15 ≤ v < 4.19.198, 4.20 ≤ v < 5.4.134, 5.5 ≤ v < 5.10.52, 5.11 ≤ v < 5.12.19, 5.13 ≤ v < 5.13.4 | 4.4.276, 4.9.276, 4.14.240, 4.19.198, 5.4.134, 5.10.52, 5.12.19, 5.13.4 |
| netapp hci_bootstrap_os | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp element_software | No range specified | — |
| debian debian_linux | 9.0, 10.0 | — |
| redhat enterprise_linux | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.