CVE-2021-27364: Infoleak
A flaw was found in the Linux kernel. An out-of-bounds read was discovered in the libiscsi module that could lead to reading kernel memory or a crash. The highest threat from this vulnerability is to data confidentiality as well as system availability.
Other sources
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsitransportiscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
An out-of-bounds read was discovered in the Linux kernel in the libiscsi module (drivers/scsi/libiscsi.c). This bug is triggered via a call to sendpdu
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-754.39.1.el6 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.24.1.rt56.1161.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.24.1.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.36.1.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-327.96.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-514.88.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.84.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.72.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.49.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.22.1.rt7.77.el8_3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-240.22.1.el8_3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.44.1.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.51.1.rt13.101.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.51.1.el8_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Disable the libiscsi kernel module from auto-loading by running: echo "install libiscsi /bin/true" >> /etc/modprobe.d/disable-libiscsi.conf. Note: this may not be suitable if the system requires iSCSI to function; restart the system if the libiscsi modules are already loaded.
Linux kernel libiscsi (modprobe/module loading) /etc/modprobe.d/disable-libiscsi.conf (install rule for libiscsi) = /bin/true
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-27364?
The severity of CVE-2021-27364 is high, impacting data confidentiality and system availability.
How do I fix CVE-2021-27364?
To fix CVE-2021-27364, update the Linux kernel to the specified remedied versions provided by your distribution.
Which Linux kernel versions are affected by CVE-2021-27364?
CVE-2021-27364 affects multiple Linux kernel versions, notably those prior to the remedied versions listed in the security advisories.
What systems are vulnerable to CVE-2021-27364?
Systems running affected versions of the Linux kernel, including specific releases from Red Hat and Debian, are vulnerable to CVE-2021-27364.
What type of vulnerability is CVE-2021-27364?
CVE-2021-27364 is an out-of-bounds read vulnerability in the Linux kernel that can lead to unauthorized data access or crashes.