Out-of-bounds Write Affecting kernel-livepatch-5_3_18-24_67-default package, versions <1-5.3.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES152-KERNELLIVEPATCH53182467DEFAULT-2679283
- published 14 Apr 2022
- disclosed 8 Jun 2021
Introduced: 8 Jun 2021
CVE-2021-3491 Open this link in a new tabHow to fix?
Upgrade SLES:15.2 kernel-livepatch-5_3_18-24_67-default to version 1-5.3.2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-5_3_18-24_67-default package and not the kernel-livepatch-5_3_18-24_67-default package as distributed by SLES.
See How to fix? for SLES:15.2 relevant fixed versions and status.
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
References
- https://www.suse.com/security/cve/CVE-2021-3491.html
- https://bugzilla.suse.com/1185642
- https://bugzilla.suse.com/1187090
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db
- https://security.netapp.com/advisory/ntap-20210716-0004/
- https://ubuntu.com/security/notices/USN-4949-1
- https://ubuntu.com/security/notices/USN-4950-1
- https://www.openwall.com/lists/oss-security/2021/05/11/13
- https://www.zerodayinitiative.com/advisories/ZDI-21-589/