VulnerabilityModified

CVE-2021-20317

A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c.

MEDIUM 4.4EPSS 0.40%

Does this matter?

Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.

CVSS 3.1: 4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.40% probability · 33th percentile
CISA KEV: Not listed
Weakness: CWE-665
Affected: linux/linux kernel · debian/debian linux
Source: secalert@redhat.com

References

https://bugzilla.redhat.com/show_bug.cgi?id=2005258Issue Tracking, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5096Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2005258Issue Tracking, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5096Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.