CVE-2021-26931

medium

Description

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.

References

http://xenbits.xen.org/xsa/advisory-362.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/

https://lists.fedoraproject.org/archives/list/[email protected]/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/

https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

https://security.netapp.com/advisory/ntap-20210326-0001/

https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html

Details

Source: MITRE

Published: 2021-02-17

Updated: 2022-06-04

Type: CWE-770

Risk Information

CVSS v2

Base Score: 1.9

Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 3.4

Severity: LOW

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 1.8

Severity: MEDIUM