CVSS 3.1
7.1 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HCVE-2021-3501
High (7.1). EPSS 0.4% chance of exploitation in the next 30 days.
A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- linux:linux_kernel
- netapp:cloud_backup
- netapp:h300e_firmware
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500e_firmware
- netapp:h500s_firmware
- netapp:h700e_firmware
- netapp:h700s_firmware
- netapp:solidfire_baseboard_management_controller_firmware
- redhat:enterprise_linux
- redhat:enterprise_linux_for_real_time
- redhat:enterprise_linux_for_real_time_for_nfv
- redhat:enterprise_linux_for_real_time_for_nfv_tus
- redhat:enterprise_linux_for_real_time_tus
- redhat:virtualization
- redhat:virtualization_host
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1950136
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a
- https://security.netapp.com/advisory/ntap-20210618-0008/
- https://bugzilla.redhat.com/show_bug.cgi?id=1950136
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a