CVE-2021-3635: Buffer Overflow
A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAPSYSADMIN) access is able to panic the system when issuing netfilter netflow commands.
Other sources
A flaw was found in the Linux kernel netfilter implementation. A user with root (CAPSYSADMIN) access is able to panic the system when issuing netfilter netflow commands
A flaw was found in the Linux kernels netfilter implementation. A missing generation check during DELTABLE processing causes it to queue the DELFLOWTABLE operation a second time possibly leading to data corruption and denial of service. An attacker must have either root or CAPSYSADMIN capabilities to exploit this flaw.
References:
https://bugzilla.redhat.com/showbug.cgi?id=1974543
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3635?
CVE-2021-3635 has a severity rating that makes it critical due to its ability to allow system panic by users with root access.
How do I fix CVE-2021-3635?
To fix CVE-2021-3635, upgrade to kernel version 5.5 or later or apply the recommended updates for kernel versions 4.18.0-348.el8 and 4.18.0-348.rt7.130.el8.
Who is affected by CVE-2021-3635?
CVE-2021-3635 affects Linux kernel versions prior to 5.5-rc7, particularly those with netfilter implemented.
What commands trigger the vulnerability in CVE-2021-3635?
The vulnerability can be triggered by issuing netfilter netflow commands by users with root (CAP_SYS_ADMIN) access.
Is CVE-2021-3635 specific to Red Hat products?
No, while Red Hat products are affected, CVE-2021-3635 impacts all distributions using vulnerable Linux kernel versions prior to 5.5-rc7.