CVE-2021-21781

LOW
Published Aug 18, 20214y ago · Modified Jun 17, 20262w ago
3.3 CVSS 3.1
Low
Find Similar
Published Aug 18, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11

CVSS Details

Base Score
3.3
Exploitability
1.8
Impact
1.4
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-908

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel5.4.54any
linuxlinux_kernel5.4.66any
oraclecommunications_cloud_native_core_binding_support_function22.1.3any
oraclecommunications_cloud_native_core_network_exposure_function22.1.1any
oraclecommunications_cloud_native_core_policy22.2.0any

References 2

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2021-1243
    ExploitThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory

Remediation

  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory