An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 10, 2021 |
| Oracle_linux | — | Upgrade kernel-uek | Apr 1, 2021 | Dec 3, 2020 |
| Ubuntu | — | Upgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-5.8.0-1023-gcpUpgrade linux-image-5.4.0-1029-raspiUpgrade linux-image-5.8.0-1016-raspi-nolpaeUpgrade linux-image-5.4.0-66-lowlatencyUpgrade linux-image-genericUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-gkeopUpgrade linux-image-gkeop-5.4Upgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-66-genericUpgrade linux-image-5.4.0-1038-oracleUpgrade linux-image-5.4.0-1040-azureUpgrade linux-image-virtualUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-oemUpgrade linux-image-azureUpgrade linux-image-5.4.0-1010-gkeopUpgrade linux-image-5.4.0-66-generic-lpaeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.8.0-1024-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.8.0-44-generic-lpaeUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.8.0-44-genericUpgrade linux-image-5.8.0-1019-kvmUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1033-kvmUpgrade linux-image-5.4.0-1038-awsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1037-gcpUpgrade linux-image-5.8.0-44-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-raspi2Upgrade linux-image-5.8.0-1016-raspiUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracleUpgrade linux-image-5.6.0-1048-oemUpgrade linux-image-5.8.0-1023-azureUpgrade linux-image-5.8.0-44-generic-64kUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1036-gkeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-awsUpgrade linux-image-gke-5.4Upgrade linux-image-5.8.0-1021-oracleUpgrade linux-image-virtual-hwe-20.04 | Feb 26, 2021 | Feb 25, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub