Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-28361

Опубликовано: 10 мар. 2021
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

A flaw was found in the SPDK iSCSI target. A NULL pointer dereference resulted from a text PDU sent with a zero-length, resulting in a crash of the SPDK iCSCI target process. The highest threat from this vulnerability is to system availability.

Отчет

  • Ceph in Red Hat Enterprise Linux is built without SPDK.
  • Red Hat OpenStack Platform deployments use the ceph package directly from the Ceph channel; the RHOSP ceph package will not be updated at this time.
  • Red Hat OpenShift Container Storage (RHOCS) 4 shipped ceph package for the usage of RHOCS 4.2 only, that has reached End Of Life. The shipped version of ceph package is no longer used and supported with the release of RHOCS 4.3.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Ceph Storage 2cephOut of support scope
Red Hat Ceph Storage 3cephAffected
Red Hat Ceph Storage 4cephAffected
Red Hat Enterprise Linux 7ceph-commonNot affected
Red Hat Enterprise Linux 8cephNot affected
Red Hat Enterprise Linux 9cephNot affected
Red Hat Openshift Container Storage 4cephWill not fix
Red Hat OpenStack Platform 13 (Queens)cephWill not fix

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-476
https://bugzilla.redhat.com/show_bug.cgi?id=1939487spdk: NULL pointer dereference in the iSCSI target If a PDU is sent with a zero length

EPSS

Процентиль: 67%
0.00537
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
nvd
почти 5 лет назад

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

CVSS3: 7.5
msrc
10 месяцев назад

Описание отсутствует

github
больше 3 лет назад

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

EPSS

Процентиль: 67%
0.00537
Низкий

7.5 High

CVSS3