CVE-2021-4115

Опубликовано: 21 фев. 2022

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

Ссылки

http://packetstormsecurity.com/files/172849/polkit-File-Descriptor-Exhaustion.html
https://access.redhat.com/security/cve/cve-2021-4115
Third Party Advisory
https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e
Patch
Third Party Advisory
https://gitlab.freedesktop.org/polkit/polkit/-/issues/141
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGKWCBS6IDZYYDYM2WIWJM5BL7QQTWPF/
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
http://packetstormsecurity.com/files/172849/polkit-File-Descriptor-Exhaustion.html
https://access.redhat.com/security/cve/cve-2021-4115
Third Party Advisory
https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e
Patch
Third Party Advisory
https://gitlab.freedesktop.org/polkit/polkit/-/issues/141
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGKWCBS6IDZYYDYM2WIWJM5BL7QQTWPF/
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:polkit_project:polkit:0.117:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 6

cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

EPSS

Процентиль: 2%

0.00015

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-400

NVD-CWE-Other

Связанные уязвимости

CVE-2021-4115

CVSS3: 5.5

ubuntu

больше 3 лет назад

CVE-2021-4115

CVSS3: 6.2

redhat

больше 3 лет назад

CVE-2021-4115

CVSS3: 5.5

debian

больше 3 лет назад

There is a flaw in polkit which can allow an unprivileged user to caus ...

openSUSE-SU-2022:0525-1

suse-cvrf

больше 3 лет назад

Security update for polkit

SUSE-SU-2022:0525-2

suse-cvrf

больше 2 лет назад

Security update for polkit

EPSS

Процентиль: 2%

0.00015

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-400

NVD-CWE-Other