CVE-2021-31916: Medium severity Linux Linux kernel vulnerability
An out-of-bounds (OOB) memory write flaw was found in listdevices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAPSYSADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Other sources
An out-of-bounds (OOB) memory write flaw was found in listdevices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel. A bound check failure allows an attacker with special user (CAPSYSADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of internal kernel information, or a privilege escalation problem.
In listdevices of dm-ioctl.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.12 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2021-10-05 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.12
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-31916?
CVE-2021-31916 is considered a high-severity vulnerability due to its potential for escalating privileges.
How do I fix CVE-2021-31916?
To address CVE-2021-31916, update your Linux kernel to version 5.12 or later, or apply the specific vendor patches provided for your operating system.
Which systems are affected by CVE-2021-31916?
CVE-2021-31916 affects multiple Linux distributions including Red Hat Enterprise Linux 7 and 8, and Debian 9.0.
What type of vulnerability is CVE-2021-31916?
CVE-2021-31916 is an out-of-bounds memory write flaw that can lead to potential privilege escalation.
Can CVE-2021-31916 be exploited remotely?
CVE-2021-31916 requires special user privileges (CAP_SYS_ADMIN) for exploitation, limiting its remote attack potential.