CVE-2021-38160

Public on 2021-08-07
Modified on 2023-01-30
Description
** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
Severity
Important severity
Important
CVSS v3 Base Score
7.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 kernel 2021-09-30 ALAS-2021-1539 Fixed
Amazon Linux 2 - Kernel-5.10 Extra kernel 2022-01-20 ALAS2KERNEL-5.10-2022-004 Fixed
Amazon Linux 2 - Kernel-5.4 Extra kernel 2022-01-20 ALAS2KERNEL-5.4-2022-006 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C
Amazon Linux CVSSv3 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C
NVD CVSSv3 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H