huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-4002: kernel: possible leak or coruption of data residing on hugetlbfs
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2021-11-25T00:00:00+00:00

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.


Affected upstream versions: affects kernel v3.6 and later through v5.15.5.
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
CVE-2021-40153: squashfs-tools: unvalidated filepaths allow writing outside of destination
Component: squashfs-tools
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Public date: 2019-09-10T00:00:00+00:00

A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the '../' string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.


Affected upstream versions: n/a
Fixed upstream versions: 4.5
Upstream repository: https://github.com/plougher/squashfs-tools
Upstream fix commit: 79b5a555058eef4e1e7ff220c344d39f8cd09646
CVE-2021-4019: vim: heap-based buffer overflow in find_help_tags() in help.c
Component: vim
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2021-11-23T00:00:00+00:00

A flaw was found in vim. A possible heap-based buffer overflow vulnerability allows an attacker to input a specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability is system availability.


Affected upstream versions: unspecified < 8.2.3669
Fixed upstream versions: 8.2.3669
Upstream repository: https://github.com/vim/vim
Upstream fix commit: bd228fd097b41a798f90944b5d1245eddd484142
CVE-2021-4028: kernel: use-after-free in RDMA listen()
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-04T00:00:00+00:00

A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free.  Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system.


Affected upstream versions: Fixed in kernel 5.15-rc1
Fixed upstream versions: v5.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: bc0bdc5afaa74
CVE-2021-4034: polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector
Component: polkit
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-01-25T17:00:00+00:00

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.


Affected upstream versions: all
Fixed upstream versions: 121
Upstream repository: https://gitlab.freedesktop.org/polkit/polkit
Upstream fix commit: a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
CVE-2021-40346: haproxy: request smuggling attack or response splitting via duplicate content-length header
Component: haproxy
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-09-08T17:37:00+00:00

Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while parsing an HTTP request. The highest threat from this vulnerability is integrity.


Affected upstream versions: n/a
Fixed upstream versions: v2.5.0
Upstream repository: https://github.com/haproxy/haproxy
Upstream fix commit: 3b69886f7dcc3cfb3d166309018e6cfec9ce2c95
CVE-2021-4037: kernel: security regression for CVE-2018-13405
Component: kernel
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2021-09-16T09:00:00+00:00

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not.  This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.

Statement: The Impact is Moderate, because if no configuration problems with the system, then unlikely higher impact than unauthorized read access.

Affected upstream versions: Fixed in Linux-kernel v5.11-rc1
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 01ea173e103e
CVE-2021-4041: Ansible: Improper shell escaping in ansible-runner
Component: Ansible
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-12-01T12:20:00+00:00

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

Statement: Satellite 6.12 and later versions are not affected by this flaw.

Affected upstream versions: Fixed in ansible-runner 2.1.0
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/ansible/ansible-runner
Upstream fix commit: 3533f265f4349a3f2a0283158cd01b59a6bbc7bd
CVE-2021-4048: lapack: Out-of-bounds read in *larrv
Component: lapack
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-30T00:00:00+00:00

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack and OpenBLAS. A specially crafted input passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.


Affected upstream versions: lapack through version 3.10.0
Fixed upstream versions: v3.10.1
Upstream repository: https://github.com/Reference-LAPACK/lapack
Upstream fix commit: 38f3eeee3108b18158409ca2a100e6fe03754781
CVE-2021-40490: kernel: race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-09-03T00:00:00+00:00

A flaw was found in the Linux kernel. A race condition was discovered in the ext4 subsystem. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: The issue is actual only if inline_data enabled for the ext4 partition, and by default it is disabled.

Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git
Upstream fix commit: 9e445093e523f3277081314c864f708fd4bd34aa
CVE-2021-40528: libgcrypt: ElGamal implementation allows plaintext recovery
Component: libgcrypt
Severity: Moderate
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-07-20T00:00:00+00:00

A flaw was found in libgcrypt's ElGamal implementation, where it allows plain text recovery. During the interaction between two cryptographic libraries, a certain combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. The highest threat from this vulnerability is to confidentiality.

Statement: Please note that there was a mixup between this CVE and CVE-2021-33560. At this time, both CVEs should be assumed to refer to the same issue. More information will be provided in the near future. See the first link in External References for more information.

Affected upstream versions: n/a
Upstream repository: https://git.gnupg.org/cgi-bin/libgcrypt.git
Upstream fix commit: 3462280f2e23e16adf3ed5176e0f2413d8861320
CVE-2021-4083: kernel: fget: check that the fd still exists after getting a ref to it
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-12-03T08:00:00+00:00

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system.


Affected upstream versions: kernel 5.16-rc4
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 054aa8d439b9
CVE-2021-41072: squashfs-tools: possible Directory Traversal via symbolic link
Component: squashfs-tools
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Public date: 2021-09-14T00:00:00+00:00

A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.


Affected upstream versions: n/a
Fixed upstream versions: 4.5.1
Upstream repository: https://github.com/plougher/squashfs-tools
Upstream fix commit: e0485802ec72996c20026da320650d8362f555bd
CVE-2021-41089: moby: `docker cp` allows unexpected chmod of host file
Component: moby
Severity: Moderate
CWE: CWE-552 (Files or Directories Accessible to External Parties)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L)
Public date: 2021-10-04T00:00:00+00:00

A file permissions vulnerability was found in Moby (Docker Engine). Copying files by using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, which might lead to permissions escalation and allow an attacker access to restricted data.

Statement: In OpenShift Container Platform (OCP), Migration Toolkit for Virtualization (MTV) and Red Hat Quay some components bundle github.com/moby/moby, but successful exploitation requires using a specially crafted container, therefore impact to these components is LOW.

Affected upstream versions: < 20.10.9
Fixed upstream versions: v20.10.9
Upstream repository: https://github.com/moby/moby
Upstream fix commit: bce32e5c93be4caf1a592582155b9cb837fc129a
CVE-2021-41099: redis: Integer overflow issue with strings
Component: redis
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-04T00:00:00+00:00

An integer overflow issue was found in redis in the underlying string library. The vulnerability involves changing the default "proto-max-bulk-len" configuration parameter to a very large value and constructing specially crafted network payloads or commands. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: < 5.0.14, >= 6.0.0, < 6.0.16, >= 6.2.0, 6.2.6
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: c6ad876774f3cc11e32681ea02a2eead00f2c521
CVE-2021-41103: containerd: insufficiently restricted permissions on container root and plugin directories
Component: containerd
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.9 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2021-10-04T00:00:00+00:00

A flaw was found in the containerd package. Containerd could allow a local authenticated attacker to traverse directories on the system, due to improper restricted permissions on the container root and plugin directories. This issue could allow an attacker to send a specially-crafted request containing "dot dot" sequences (/../) to view directory contents and execute programs.


Affected upstream versions: < 1.4.11, >= 1.5.0, < 1.5.7
Fixed upstream versions: v1.4.11
Upstream repository: https://github.com/containerd/containerd
Upstream fix commit: 5b46e404f6b9f661a205e28d59c982d3634148f8
CVE-2021-41133: flatpak: Sandbox bypass via recent VFS-manipulating syscalls
Component: flatpak
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-10-08T00:00:00+00:00

A flaw was found in the flatpak package. It is susceptible to a software flaw that can deceive portals and other host-OS services into treating the flatpak app as an ordinary, non-sandboxed host-OS process. This flaw allows the escalation of privileges that the corresponding services presume the flatpak app has. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: >= 1.8.0, <= 1.8.2, >= 1.10.0, < 1.10.4, >= 1.11.0, < 1.12.0
Fixed upstream versions: 1.12.0
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 1330662f33a55e88bfe18e76de28b7922d91a999
CVE-2021-41136: rubygem-puma: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
Component: rubygem-puma
Severity: Low
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)
Public date: 2021-10-12T00:00:00+00:00

An HTTP Request Smuggling vulnerability was found in puma. When using puma with a proxy, which forwards LF characters as line endings, an attacker could use this flaw to smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

Statement: Red Hat CloudForms 5.0 (CFME 5.11) is in the maintenance phase and Medium and Low impact security bugs will not be fixed. See https://access.redhat.com/support/policy/updates/cloudforms for additional information.

Affected upstream versions: >= 5.0.0, < 5.5.1, < 4.3.9
Upstream repository: https://github.com/puma/puma
Upstream fix commit: 436c71807f00e07070902a03f79fd3e130eb6b18
CVE-2021-41182: jquery-ui: XSS in the altField option of the datepicker widget
Component: jquery-ui
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2021-10-25T00:00:00+00:00

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.


Affected upstream versions: < 1.13.0
Upstream repository: https://github.com/jquery/jquery-ui
Upstream fix commit: 6809ce843e5ac4128108ea4c15cbc100653c2b63
CVE-2021-41184: jquery-ui: XSS in the 'of' option of the .position() util
Component: jquery-ui
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2021-10-25T00:00:00+00:00

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.


Affected upstream versions: < 1.13.0
Fixed upstream versions: 1.13.0
Upstream repository: https://github.com/jquery/jquery-ui
Upstream fix commit: effa323f1505f2ce7a324e4f429fa9032c72f280
CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion
Component: opencontainers
Severity: Low
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
Public date: 2021-11-17T00:00:00+00:00

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manifest or an index. In the OCI Image Specification version 1.0.1 there is specified a recommendation that both manifest and index documents contain a `mediaType` field to identify the type of document.

Statement: As a consequence of the OCI Image Specification (and OCI Distribution Specification [1]), container runtime engines (like containerd, moby - Docker Engine, cri-o) deliver updates to adopt new `mediaType` field used for identification of the document type. Even though some Red Hat products rely on container engine, the impact by this issue is LOW.

[1] https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m

Affected upstream versions: < 1.0.1
Fixed upstream versions: v1.0.1
Upstream repository: https://github.com/opencontainers/distribution-spec
Upstream fix commit: ac28cac0557bcd3084714ab09f9f2356fe504923
CVE-2021-4122: cryptsetup: disable encryption via header rewrite
Component: cryptsetup
Severity: Moderate
CWE: CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data)
CVSS v3: 5.9 (CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2022-01-13T00:00:00+00:00

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Statement: Red Hat Enterprise Linux version 7 and older are not affected since they do not support online reencryption.

Affected upstream versions: Fixed in cryptsetup 2.4.3, cryptsetup 2.3.7
Fixed upstream versions: v2.5.0
Upstream repository: https://gitlab.com/cryptsetup/cryptsetup
Upstream fix commit: 0113ac2d889c5322659ad0596d4cfc6da53e356c
CVE-2021-41269: cron-utils: template Injection leading to unauthenticated Remote Code Execution
Component: cron-utils
Severity: Critical
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-11-17T00:00:00+00:00

A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution (RCE) via Java Expression Language (EL) injection.

Statement: Only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

Affected upstream versions: < 9.1.6
Fixed upstream versions: 9.1.6
Upstream repository: https://github.com/jmrozanec/cron-utils
Upstream fix commit: cfd2880f80e62ea74b92fa83474c2aabdb9899da
CVE-2021-4145: QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c
Component: QEMU
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2021-12-10T00:00:00+00:00

A NULL pointer dereference issue was found in the block mirror layer of QEMU. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.

Statement: Releases of Red Hat OpenStack Platform 15 and newer, Red Hat Virtualization 4.4 and newer consume fixes directly from the Red Hat Enterprise Linux 8 Advanced Virtualization repository.

Affected upstream versions: qemu-kvm 6.2.0
Fixed upstream versions: v6.2.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: 66fed30c9cd11854fc878a4eceb507e915d7c9cd
CVE-2021-4154: kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-12-14T00:00:00+00:00

A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.


Affected upstream versions: Fixed in kernel 5.14 rc2
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3b0462726e7ef281c35a7a4ae33e93ee2bc9975b
CVE-2021-4155: kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL
Component: kernel
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-01-10T06:36:00+00:00

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.


Affected upstream versions: Fixed in Kernel v5.16
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 983d8e60f50806f90534cc5373d0ce867e5aaf79