A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2034514 | Issue Tracking Patch Third Party Advisory |
| https://cloud.google.com/anthos/clusters/docs/security-bulletins#gcp-2022-002 | Third Party Advisory |
| https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b | Mailing List Patch Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220225-0004/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
19 Jan 2023, 15:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE |
01 Mar 2022, 15:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_baseboard_management_controller:h300e:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_baseboard_management_controller:h700e:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_baseboard_management_controller:h500e:*:*:*:*:*:*:* |
|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220225-0004/ - Third Party Advisory | |
| References | (MISC) https://cloud.google.com/anthos/clusters/docs/security-bulletins#gcp-2022-002 - Third Party Advisory | |
| First Time |
Netapp
Netapp hci Baseboard Management Controller |
25 Feb 2022, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Feb 2022, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Feb 2022, 02:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2034514 - Issue Tracking, Patch, Third Party Advisory | |
| References | (MISC) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b - Mailing List, Patch, Vendor Advisory | |
| CPE | cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* |
|
| First Time |
Linux linux Kernel
Redhat enterprise Linux Linux Redhat virtualization Redhat |
|
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 8.8 |
04 Feb 2022, 23:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-04 23:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-4154
Mitre link : CVE-2021-4154
CVE.ORG link : CVE-2021-4154
JSON object : View
Products Affected
redhat
- virtualization
- enterprise_linux
netapp
- hci_baseboard_management_controller
linux
- linux_kernel
CWE
CWE-416
Use After Free