CVE-2021-25225: Trend Micro ServerProtect splx_schedule_scan Memory Exhaustion Denial-Of-Service Vulnerability
A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cause a denial-of-service on the affected product. The specific flaw exists within a scheduled scan component. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Trend Micro ServerProtect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the splxschedulescan executable. The issue results from the lack of proper validation of user-supplied data, which can result in a memory exhaustion condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-25225?
CVE-2021-25225 is a vulnerability that allows remote attackers to create a denial-of-service condition on affected installations of Trend Micro ServerProtect.
How can CVE-2021-25225 be exploited?
CVE-2021-25225 can be exploited by visiting a malicious page or opening a malicious file.
Which software is affected by CVE-2021-25225?
CVE-2021-25225 affects installations of Trend Micro ServerProtect version 3.0.
What is the severity of CVE-2021-25225?
CVE-2021-25225 has a severity rating of medium (5.5).
How can I fix CVE-2021-25225?
To fix CVE-2021-25225, apply the security patch or update provided by Trend Micro.