VIR Vulnerability Intelligence Relay

CVE-2021-33655

high
Published 2023-05-09 · Modified 2023-05-12
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
8.0

Description

Important: kernel security, bug fix, and enhancement update

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory Red Hat statement Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. CVSS v3: 6.7…

Workaround

for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Description

kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory

Red Hat statement

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Errata / fixed releases

ProductPackageAdvisoryReleased
Red Hat Enterprise Linux 8kernel-rt-0:4.18.0-477.10.1.rt7.274.el8_8RHSA-2023:27362023-05-16T00:00:00Z
Red Hat Enterprise Linux 8kernel-0:4.18.0-477.10.1.el8_8RHSA-2023:29512023-05-16T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Supportkernel-0:4.18.0-372.93.1.el8_6RHSA-2024:09302024-02-21T00:00:00Z
Red Hat Enterprise Linux 9kernel-0:5.14.0-284.11.1.el9_2RHSA-2023:24582023-05-09T00:00:00Z
Red Hat Enterprise Linux 9kernel-rt-0:5.14.0-284.11.1.rt14.296.el9_2RHSA-2023:21482023-05-09T00:00:00Z
Red Hat Enterprise Linux 9kernel-0:5.14.0-284.11.1.el9_2RHSA-2023:24582023-05-09T00:00:00Z
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8kernel-0:4.18.0-372.93.1.el8_6RHSA-2024:09302024-02-21T00:00:00Z

Package state

ProductPackageState
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelOut of support scope
Red Hat Enterprise Linux 7kernel-rtOut of support scope

Apply commands

bash fix
Apply RHSA-2023:2736 for Red Hat Enterprise Linux 8
yum update -y kernel-rt
# or:
dnf upgrade -y kernel-rt

Affected

VendorProductVersion
redhatRed Hat Enterprise Linux 6Not affected

OS impact
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
almalinux AlmaLinux Fixed 2 releases
VersionStatusFixed in
9 Fixed kernel-devel-matched-5.14.0-284.11.1.el9_2.aarch64.rpm
8 Fixed kernel-rt-debug-core-4.18.0-477.10.1.rt7.274.el8_8.x86_64.rpm
arch Arch Fixed 1 release
VersionStatusFixed in
— Fixed 5.18.11.arch1-1
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 5.18.14-1
sid Fixed 5.18.14-1
forky Fixed 5.18.14-1
bullseye Fixed 5.10.127-2
bookworm Fixed 5.18.14-1
redhat Red Hat Fixed 2 releases
VersionStatusFixed in
9 Fixed —
8 Fixed —

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.