CVE-2021-43389: Out-of-bounds Read
First published: Fri Sep 24 2021(Updated: )
An improper validation of an array index and out of bounds memory read in the Linux kernel's Integrated Services Digital Network (ISDN) functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this flaw to crash the system or starve the resources causing denial of service.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-372.9.1.rt7.166.el8 | 0:4.18.0-372.9.1.rt7.166.el8 |
| redhat/kernel | <0:4.18.0-372.9.1.el8 | 0:4.18.0-372.9.1.el8 |
| redhat/Linux kernel | <5.15 | 5.15 |
| Linux Kernel | <5.14.15 | |
| Red Hat Enterprise Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Debian Linux | =10.0 | |
| Oracle Communications Cloud Native Core Binding Support Function | =22.1.3 | |
| Oracle Communications Cloud Native Core Network Exposure Function | =22.1.1 | |
| Oracle Communications Cloud Native Core Policy | =22.2.0 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.133-1 6.12.21-1 6.12.22-1 |
Remedy
To mitigate this issue, prevent the module isdn from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-43389 https://nvd.nist.gov/vuln/detail/CVE-2021-43389 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
- https://bugzilla.redhat.com/show_bug.cgi?id=2013180
- https://access.redhat.com/errata/RHSA-2022:1975
- https://access.redhat.com/errata/RHSA-2022:1988
- https://access.redhat.com/security/cve/cve-2021-43389
- http://www.openwall.com/lists/oss-security/2021/11/05/1
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
- https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
- https://seclists.org/oss-sec/2021/q4/39
- https://www.debian.org/security/2022/dsa-5096
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://launchpad.net/bugs/cve/CVE-2021-43389
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2013181
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2016620
- https://access.redhat.com/security/cve/CVE-2021-3896
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
- https://www.cve.org/CVERecord?id=CVE-2021-3896
- https://www.cve.org/CVERecord?id=CVE-2021-43389
- https://access.redhat.com/security/cve/CVE-2021-43389
- https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA%40mail.gmail.com/
- https://nvd.nist.gov/vuln/detail/CVE-2021-43389
- https://security-tracker.debian.org/tracker/CVE-2021-43389
- https://ubuntu.com/security/CVE-2021-43389
- https://www.openwall.com/lists/oss-security/2021/10/19/1
- https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
Frequently Asked Questions
What is the severity of CVE-2021-43389?
CVE-2021-43389 has a severity rating that may allow local users to crash the system or cause denial of service.
How do I fix CVE-2021-43389?
To fix CVE-2021-43389, update to kernel-rt version 0:4.18.0-372.9.1.rt7.166.el8 or kernel version 0:4.18.0-372.9.1.el8.
Which systems are affected by CVE-2021-43389?
CVE-2021-43389 affects multiple Linux kernel versions and specific distributions such as Red Hat Enterprise Linux and Debian.
Can CVE-2021-43389 be exploited remotely?
CVE-2021-43389 is a local vulnerability, meaning it requires local access to exploit.
What versions of the Linux kernel are vulnerable to CVE-2021-43389?
Linux kernel versions up to 5.14.15 are vulnerable to CVE-2021-43389.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-43389
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/references
- agent/remedy
- agent/trending
- agent/source
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/8.0
- vendor/debian
- canonical/debian linux
- version/debian linux/9.0
- version/debian linux/10.0
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- canonical/oracle communications cloud native core network exposure function
- version/oracle communications cloud native core network exposure function/22.1.1
- canonical/oracle communications cloud native core policy
- version/oracle communications cloud native core policy/22.2.0
- package-manager/debian