SB2021031526 - Missing authorization in Linux kernel misc driver
Published: March 15, 2021 Updated: May 13, 2025
Security Bulletin ID
SB2021031526
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Missing authorization (CVE-ID: CVE-2021-28375)
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to missing authorization error within the fastrpc_internal_invoke() function in drivers/misc/fastrpc.c. A local user can execute arbitrary code.
Remediation
Install update from vendor's website.
References
- https://lore.kernel.org/stable/YD03ew7+6v0XPh6l@kroah.com/
- https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMRQVOTASD3VZP6GE4JJHE27QU6FHTZ6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJPVQZPY3DHPV5I3IVNMSMO6D3PKZISX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XAUNYDTGE6MB4NWL2SIHPCODCLET3JZB/
- https://security.netapp.com/advisory/ntap-20210401-0003/
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.24
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.7
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.106