NVD Vulnerability Detail

CVE-2021-28375

Summary	An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308.
Publication Date	March 15, 2021, 2:15 p.m.
Registration Date	March 15, 2021, 8:03 p.m.
Last Update	Nov. 21, 2024, 2:59 p.m.

Affected software configurations

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:netapp:cloud_backup:-:::::::*
cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6	Mailing List Patch Vendor Advisory
2	https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6	Mailing List Patch Vendor Advisory
3	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMRQVOTASD3VZP6GE4JJHE27QU6FHTZ6/
4	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMRQVOTASD3VZP6GE4JJHE27QU6FHTZ6/
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XAUNYDTGE6MB4NWL2SIHPCODCLET3JZB/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XAUNYDTGE6MB4NWL2SIHPCODCLET3JZB/
9	https://lore.kernel.org/stable/YD03ew7+6v0XPh6l%40kroah.com/
10	https://lore.kernel.org/stable/YD03ew7+6v0XPh6l%40kroah.com/
11	https://security.netapp.com/advisory/ntap-20210401-0003/	Third Party Advisory
12	https://security.netapp.com/advisory/ntap-20210401-0003/	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-862	認証の欠如	https://cwe.mitre.org/data/definitions/862.html

JVN Vulnerability Information

Linux Kernel における権限管理に関する脆弱性

Title	Linux Kernel における権限管理に関する脆弱性
Summary	Linux Kernel には、権限管理に関する脆弱性が存在します。ベンダは、本脆弱性を CID-20c40794eb85 として公開しています。本脆弱性は、CVE-2019-2308 と関連する脆弱性です。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 10, 2021, midnight
Registration Date	Nov. 22, 2021, 5:57 p.m.
Last Update	Nov. 22, 2021, 5:57 p.m.

Affected System

Fedora Project

Fedora

Linux

Linux Kernel 5.11.6 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-28375	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28375
National Vulnerability Database (NVD)
2	CVE-2021-28375	https://nvd.nist.gov/vuln/detail/CVE-2021-28375

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-269	https://cwe.mitre.org/data/definitions/269.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2021-14f6642aa6	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XAUNYDTGE6MB4NWL2SIHPCODCLET3JZB/
2	FEDORA-2021-90083c9c0f	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMRQVOTASD3VZP6GE4JJHE27QU6FHTZ6/
3	FEDORA-2021-bb755ed5e3	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/
kernel.org
4	Re: [PATCH v2] misc: fastrpc: restrict user apps from sending kernel RPC messages	https://lore.kernel.org/stable/YD03ew7+6v0XPh6l@kroah.com/
Linux Kernel
5	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
6	misc: fastrpc: restrict user apps from sending kernel RPC messages	https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6

Change Log

No	Changed Details	Date of change
1	[2021年11月22日] 掲載	Nov. 22, 2021, 5:57 p.m.