CVE-2021-20226
Last modified
CVE-2021-20226 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 5.5, < 5.8.18 |
| Linux | Linux Kernel | >= 5.9.0, < 5.9.3 |
| Netapp | Cloud Backup | All versions |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1873476Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210401-0001/Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1873476Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210401-0001/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-20226?
How severe is CVE-2021-20226?
How do I fix CVE-2021-20226?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-20220A flaw was found in Undertow. A regression in the fix for CV…4.8
- CVE-2021-20221An out-of-bounds heap buffer access issue was found in the A…6
- CVE-2021-20222A flaw was found in keycloak. The new account console in key…7.5
- CVE-2021-20223Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-20224An integer overflow issue was discovered in ImageMagick's Ex…5.5
- CVE-2021-20225A flaw was found in grub2 in versions prior to 2.06. The opt…6.7
- CVE-2021-20227A flaw was found in SQLite's SELECT query functionality (src…5.5
- CVE-2021-20228A flaw was found in the Ansible Engine 2.9.18, where sensiti…7.5
- CVE-2021-20229A flaw was found in PostgreSQL in versions before 13.2. This…4.3
- CVE-2021-2023Vulnerability in the Oracle Installed Base product of Oracle…4.7
- CVE-2021-20230A flaw was found in stunnel before 5.57, where it improperly…7.5
- CVE-2021-20231A flaw was found in gnutls. A use after free issue in client…9.8
Are you affected by CVE-2021-20226?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST