First published: Mon Oct 04 2021(Updated: )
A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
Linux Linux kernel | >=5.10<5.10.71 | |
Linux Linux kernel | >=5.11<5.14.10 | |
SUSE Linux Enterprise | =15.0-sp3 | |
SUSE Linux Enterprise | =15.0-sp4 | |
redhat/kernel-rt | <0:3.10.0-1160.62.1.rt56.1203.el7 | 0:3.10.0-1160.62.1.rt56.1203.el7 |
redhat/kernel | <0:3.10.0-1160.62.1.el7 | 0:3.10.0-1160.62.1.el7 |
redhat/kernel | <0:3.10.0-514.101.1.el7 | 0:3.10.0-514.101.1.el7 |
redhat/kernel | <0:3.10.0-693.100.1.el7 | 0:3.10.0-693.100.1.el7 |
redhat/kernel | <0:3.10.0-957.94.1.el7 | 0:3.10.0-957.94.1.el7 |
redhat/kernel | <0:3.10.0-1062.66.1.el7 | 0:3.10.0-1062.66.1.el7 |
redhat/kernel-rt | <0:4.18.0-348.23.1.rt7.153.el8_5 | 0:4.18.0-348.23.1.rt7.153.el8_5 |
redhat/kernel | <0:4.18.0-348.23.1.el8_5 | 0:4.18.0-348.23.1.el8_5 |
redhat/kernel | <0:4.18.0-147.64.1.el8_1 | 0:4.18.0-147.64.1.el8_1 |
redhat/kernel-rt | <0:4.18.0-193.75.1.rt13.125.el8_2 | 0:4.18.0-193.75.1.rt13.125.el8_2 |
redhat/kernel | <0:4.18.0-193.75.1.el8_2 | 0:4.18.0-193.75.1.el8_2 |
redhat/kernel-rt | <0:4.18.0-305.40.1.rt7.112.el8_4 | 0:4.18.0-305.40.1.rt7.112.el8_4 |
redhat/kernel | <0:4.18.0-305.40.1.el8_4 | 0:4.18.0-305.40.1.el8_4 |
redhat/redhat-virtualization-host | <0:4.3.22-20220330.1.el7_9 | 0:4.3.22-20220330.1.el7_9 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2021-4028 is a vulnerability in the Linux kernel's implementation of RDMA communications manager listener code.
CVE-2021-4028 has a severity value of 7, which is considered high.
The affected software includes Red Hat kernel versions up to 5.15, kernel-rt versions up to 3.10.0-1160.62.1.rt56.1203.el7, and SUSE Linux Enterprise versions 15.0-sp3 and 15.0-sp4.
To fix CVE-2021-4028, you need to update your Linux kernel to a version that includes the necessary patches. Refer to the vendor's security advisory for the specific kernel versions that address the vulnerability.
You can find more information about CVE-2021-4028 in the Red Hat bugzilla and SUSE bugzilla links provided, as well as the Red Hat security advisory.