CVE-2021-43395

EUVD-2021-30330
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unprivileged user can cause a deadlock and kernel panic via crafted rename and rmdir calls on tmpfs filesystems. Oracle Solaris 10 and 11 is also affected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADPADP
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
illumosillumos
𝑥
< 2022-01-18
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.tribblix.org/relnotes.html
https://github.com/illumos/illumos-gate/blob/069654420de4aade43c63c43cd2896e66945fc8a/usr/src/uts/common/fs/tmpfs/tmp_vnops.c
https://github.com/illumos/illumos-gate/blob/b3403853e80914bd0aade9b5b605da4878078173/usr/src/uts/common/fs/tmpfs/tmp_dir.c
https://github.com/illumos/illumos-gate/commit/f859e7171bb5db34321e45585839c6c3200ebb90
https://illumos.topicbox.com/groups/developer/T1c9e4f27f8c2f959/security-heads-up-illumos14424
https://jgardner100.wordpress.com/2022/01/20/security-heads-up/
https://kebe.com/blog/?p=505
https://www.illumos.org/issues/14424
https://www.oracle.com/security-alerts/cpujan2022.html
http://www.tribblix.org/relnotes.html
https://github.com/illumos/illumos-gate/blob/069654420de4aade43c63c43cd2896e66945fc8a/usr/src/uts/common/fs/tmpfs/tmp_vnops.c
https://github.com/illumos/illumos-gate/blob/b3403853e80914bd0aade9b5b605da4878078173/usr/src/uts/common/fs/tmpfs/tmp_dir.c
https://github.com/illumos/illumos-gate/commit/f859e7171bb5db34321e45585839c6c3200ebb90
https://illumos.topicbox.com/groups/developer/T1c9e4f27f8c2f959/security-heads-up-illumos14424
https://jgardner100.wordpress.com/2022/01/20/security-heads-up/
https://kebe.com/blog/?p=505
https://www.illumos.org/issues/14424
https://www.oracle.com/security-alerts/cpujan2022.html