CVE-2021-3759: Medium severity linux kernel vulnerability
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
There is a missing-accounting vulnerability in memcg subsystem of Linux kernel, leading to out of memory and then host system crashes because of this.
Reference: https://lore.kernel.org/linux-mm/1626333284-1404-1-git-send-email-nglaive@gmail.com/
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3759?
CVE-2021-3759 has a high severity rating due to its potential to cause denial of service through resource starvation.
How do I fix CVE-2021-3759?
To fix CVE-2021-3759, you should upgrade to the specified patched versions of the Linux kernel, such as kernel-rt 0:4.18.0-372.9.1.rt7.166.el8 or 5.10.223-1 and newer.
What systems are affected by CVE-2021-3759?
CVE-2021-3759 affects various Linux distributions including Red Hat Enterprise Linux and Debian.
Can CVE-2021-3759 be exploited remotely?
CVE-2021-3759 cannot be exploited remotely as it requires local user access to the system.
What component of the Linux kernel does CVE-2021-3759 impact?
CVE-2021-3759 impacts the IPC functionality within the memory control group (memcg) subsystem of the Linux kernel.