CVE-2021-3744
First published: Fri Aug 20 2021(Updated: )
A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-372.9.1.rt7.166.el8 | 0:4.18.0-372.9.1.rt7.166.el8 |
| redhat/kernel | <0:4.18.0-372.9.1.el8 | 0:4.18.0-372.9.1.el8 |
| Linux Kernel | <5.15 | |
| Linux Kernel | =5.15 | |
| Linux Kernel | =5.15-rc1 | |
| Linux Kernel | =5.15-rc2 | |
| Linux Kernel | =5.15-rc3 | |
| Red Hat Fedora | =33 | |
| Red Hat Fedora | =34 | |
| Red Hat Fedora | =35 | |
| Debian Linux | =9.0 | |
| Debian Linux | =10.0 | |
| Red Hat Quarkus | =2.0 | |
| Red Hat CodeReady Linux Builder | =8.0 | |
| Red Hat CodeReady Linux Builder | =8.6 | |
| Red Hat CodeReady Linux Builder for Power, little endian | =8.0 | |
| Red Hat CodeReady Linux Builder for Power, little endian | =8.6 | |
| Red Hat Developer Tools | =1.0 | |
| Red Hat Enterprise Linux Server EUS | =8.6 | |
| Red Hat Enterprise Linux for IBM Z Systems (s390x) | =8.6 | |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | =8.6 | |
| Red Hat Enterprise Linux for Real Time | =8 | |
| Red Hat Enterprise Linux for Real Time | =8.6 | |
| Red Hat Enterprise Linux for Real Time for NFV | =8 | |
| Red Hat Enterprise Linux for Real Time for NFV | =8.6 | |
| Red Hat Enterprise Linux Server | =8.6 | |
| Red Hat Enterprise Linux for SAP Applications for Power, little endian - Extended Update Support | =8.6 | |
| Red Hat Enterprise Linux Server | =8.6 | |
| Red Hat Enterprise Linux Server Update Services for SAP Solutions | =8.6 | |
| All of | ||
| Red Hat Virtualization Host EUS | =4.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| Oracle Communications Cloud Native Core Binding Support Function | =22.1.3 | |
| Oracle Communications Cloud Native Core Network Exposure Function | =22.1.1 | |
| Oracle Communications Cloud Native Core Policy | =22.2.0 | |
| Red Hat Virtualization Host EUS | =4.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.133-1 6.12.21-1 6.12.22-1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation baser or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-3744 https://nvd.nist.gov/vuln/detail/CVE-2021-3744 https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
- https://bugzilla.redhat.com/show_bug.cgi?id=2000627
- https://access.redhat.com/errata/RHSA-2022:1975
- https://access.redhat.com/errata/RHSA-2022:1988
- https://access.redhat.com/security/cve/cve-2021-3744
- http://www.openwall.com/lists/oss-security/2021/09/14/1
- https://github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680
- https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
- https://seclists.org/oss-sec/2021/q3/164
- https://www.debian.org/security/2022/dsa-5096
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://launchpad.net/bugs/cve/CVE-2021-3744
- https://access.redhat.com/security/cve/CVE-2019-18808
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2009413
- https://git.kernel.org/linus/505d9dcb0f7ddf9d075e729523a33d38642ae680
- https://security-tracker.debian.org/tracker/CVE-2021-3744
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
- https://nvd.nist.gov/vuln/detail/CVE-2021-3744
- https://ubuntu.com/security/CVE-2021-3744
Frequently Asked Questions
What is the severity of CVE-2021-3744?
CVE-2021-3744 has a high severity rating because it can lead to denial of service due to a memory leak in the Linux kernel.
How do I fix CVE-2021-3744?
To fix CVE-2021-3744, update to the recommended kernel versions specified by your Linux distribution vendor.
Which software versions are affected by CVE-2021-3744?
CVE-2021-3744 affects multiple versions of the Linux kernel, including Kernel-RT and standard kernels up to certain releases.
Can CVE-2021-3744 be exploited remotely?
CVE-2021-3744 primarily affects system availability and can potentially be exploited remotely by attackers.
What is the impact of CVE-2021-3744 on system performance?
CVE-2021-3744 can cause system performance degradation and unavailability due to memory leaks leading to denial of service.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3744
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/trending
- agent/source
- agent/author
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.15
- version/linux kernel/5.15-rc1
- version/linux kernel/5.15-rc2
- version/linux kernel/5.15-rc3
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/33
- version/red hat fedora/34
- version/red hat fedora/35
- vendor/debian
- canonical/debian linux
- version/debian linux/9.0
- version/debian linux/10.0
- vendor/redhat
- canonical/red hat quarkus
- version/red hat quarkus/2.0
- canonical/red hat codeready linux builder
- version/red hat codeready linux builder/8.0
- version/red hat codeready linux builder/8.6
- canonical/red hat codeready linux builder for power, little endian
- version/red hat codeready linux builder for power, little endian/8.0
- version/red hat codeready linux builder for power, little endian/8.6
- canonical/red hat developer tools
- version/red hat developer tools/1.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/8.6
- canonical/red hat enterprise linux for ibm z systems (s390x)
- version/red hat enterprise linux for ibm z systems (s390x)/8.6
- canonical/red hat enterprise linux for power, little endian - extended update support
- version/red hat enterprise linux for power, little endian - extended update support/8.6
- canonical/red hat enterprise linux for real time
- version/red hat enterprise linux for real time/8
- version/red hat enterprise linux for real time/8.6
- canonical/red hat enterprise linux for real time for nfv
- version/red hat enterprise linux for real time for nfv/8
- version/red hat enterprise linux for real time for nfv/8.6
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/8.6
- canonical/red hat enterprise linux for sap applications for power, little endian - extended update support
- version/red hat enterprise linux for sap applications for power, little endian - extended update support/8.6
- canonical/red hat enterprise linux server update services for sap solutions
- version/red hat enterprise linux server update services for sap solutions/8.6
- canonical/red hat virtualization host eus
- version/red hat virtualization host eus/4.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- canonical/oracle communications cloud native core network exposure function
- version/oracle communications cloud native core network exposure function/22.1.1
- canonical/oracle communications cloud native core policy
- version/oracle communications cloud native core policy/22.2.0
- package-manager/debian