CVE-2021-3744: Medium severity linux kernel vulnerability
A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
Other sources
A memory leak flaw was found in the Linux kernel in the ccprunaesgcmcmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
A memory leak in the ccprunaesgcmcmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel allows attackers to cause a denial of service (memory consumption).
The patch for this one fixes: 1) If we ccpinitdata() fails for &src then we need to free aad. Use goto eaad instead of goto ectx. 2) The label to free the &finalwa was named incorrectly as "etag" but it should have been "efinalwa". One error path leaked &finalwa. 3) The &tag was leaked on one error path. In that case, I added a free before the goto because the resource was local to that block.
This vulnerability is similar with the older CVE-2019-18808.
Reference: https://seclists.org/oss-sec/2021/q3/164
— Red Hat
Affected Software
Remediation
Information
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3744?
CVE-2021-3744 has a high severity rating because it can lead to denial of service due to a memory leak in the Linux kernel.
How do I fix CVE-2021-3744?
To fix CVE-2021-3744, update to the recommended kernel versions specified by your Linux distribution vendor.
Which software versions are affected by CVE-2021-3744?
CVE-2021-3744 affects multiple versions of the Linux kernel, including Kernel-RT and standard kernels up to certain releases.
Can CVE-2021-3744 be exploited remotely?
CVE-2021-3744 primarily affects system availability and can potentially be exploited remotely by attackers.
What is the impact of CVE-2021-3744 on system performance?
CVE-2021-3744 can cause system performance degradation and unavailability due to memory leaks leading to denial of service.