CVE-2021-38160: Input Validation
DISPUTED In drivers/char/virtioconsole.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
Other sources
This CVE is being DISPUTED () by Red Hat with a note that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
() https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38160
Reference and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d00d8da5869a2608e97cfede094dfc5e11462a46
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-38160?
The severity of CVE-2021-38160 is disputed, as the vendor claims the data corruption is not an actual vulnerability in the existing software.
How do I fix CVE-2021-38160?
To fix CVE-2021-38160, update to a version of the Linux kernel that is 5.13.4 or newer.
What systems are affected by CVE-2021-38160?
CVE-2021-38160 affects various versions of the Linux kernel prior to 5.13.4, including those in Debian and Red Hat distributions.
What kind of attack is CVE-2021-38160 associated with?
CVE-2021-38160 is associated with potential data corruption or loss caused by untrusted devices supplying excessive buffer lengths.
Is CVE-2021-38160 a critical vulnerability?
CVE-2021-38160 is not classified as critical since the vendor asserts that the issue does not represent a vulnerability under existing conditions.