CVE-2021-3764: Medium severity Linux Linux kernel vulnerability
A memory leak flaw was found in the Linux kernel's ccprunaesgcmcmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
Other sources
A memory leak in the ccprunaesgcmcmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel allows attackers to cause a denial of service (memory consumption). It happens if function ccpinitdata(&src) returns error code (that is being called from the ccprunaesgcmcmd). This vulnerability is similar with the older CVE-2019-18808 and both with the CVE-2021-3744 (and the patch for the CVE-2021-3744 contains fix for this one too).
Reference: TODO: add link to the patch when available
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3764?
CVE-2021-3764 has a high severity level due to its potential to cause denial of service.
How do I fix CVE-2021-3764?
To fix CVE-2021-3764, update the Linux kernel to one of the recommended patched versions provided by your distribution.
What systems are affected by CVE-2021-3764?
CVE-2021-3764 affects various versions of the Linux kernel, specifically those prior to version 5.15.
What type of vulnerability is CVE-2021-3764?
CVE-2021-3764 is a memory leak vulnerability found in the ccp_run_aes_gcm_cmd() function of the Linux kernel.
Can CVE-2021-3764 be exploited remotely?
CVE-2021-3764 could potentially be exploited by an attacker with local access to trigger the memory leak and cause denial of service.