Bug 1944298 (CVE-2021-3506) - CVE-2021-3506 kernel: Out of bounds memory access bug in get_next_net_page() in fs/f2fs/node.c
Summary: CVE-2021-3506 kernel: Out of bounds memory access bug in get_next_net_page() ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2021-3506
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1944299
Blocks: 1944300 1951187
TreeView+ depends on / blocked
 
Reported: 2021-03-29 17:46 UTC by Pedro Sampaio
Modified: 2021-06-29 16:12 UTC (History)
45 users (show)

Fixed In Version: kernel 5.12.0-rc4
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-04-20 10:46:28 UTC


Attachments (Terms of Use)

Description Pedro Sampaio 2021-03-29 17:46:04 UTC
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

References:

https://www.openwall.com/lists/oss-security/2021/03/28/2
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2520013.html

Comment 1 Pedro Sampaio 2021-03-29 17:46:43 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1944299]

Comment 3 Rohit Keshri 2021-04-19 10:08:54 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 4 Rohit Keshri 2021-04-19 10:09:33 UTC
Statement:

There was no shipped kernel version were seen affected with this problem. These files are not built in our source code.

Comment 9 Product Security DevOps Team 2021-04-20 10:46:28 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3506

Comment 10 Product Security DevOps Team 2021-04-20 16:46:29 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3506

Comment 11 Justin M. Forbes 2021-06-29 16:12:32 UTC
This was fixed for Fedora in the 5.11.20 stable kernel updates.


Note You need to log in before you can comment on or make changes to this bug.