vulnerability

Alma Linux: CVE-2021-27363: Important: kernel security, bug fix, and enhancement update (ALSA-2021-1093)

Severity
4
CVSS
(AV:L/AC:L/Au:N/C:P/I:N/A:P)
Published
Mar 7, 2021
Added
May 4, 2022
Modified
Sep 15, 2022

Description

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

Solution(s)

alma-upgrade-kernel-abi-whitelistsalma-upgrade-kernel-tools-libs-devel
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.