CVE-2021-29647: Medium severity Linux Linux kernel vulnerability
An issue was discovered in the Linux kernel before 5.11.11. qrtrrecvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.
Other sources
In qrtrrecvmsg of qrtr.c, there is a possible leak of kernel memory due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2021-10-05 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.11.11
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29647?
CVE-2021-29647 is classified as a medium severity vulnerability due to its potential to expose sensitive information from kernel memory.
How do I fix CVE-2021-29647?
To fix CVE-2021-29647, update your Linux kernel to version 5.11.11 or newer.
Which systems are affected by CVE-2021-29647?
CVE-2021-29647 affects various Linux kernel versions prior to 5.11.11, including specific releases of Google Android, Fedora, and Debian.
What type of vulnerability is CVE-2021-29647?
CVE-2021-29647 is a memory vulnerability that allows attackers to obtain sensitive information due to a partially uninitialized data structure.
When was CVE-2021-29647 discovered?
CVE-2021-29647 was discovered before the release of Linux kernel version 5.11.11.