{"id":"USN-5139-1","summary":"linux-oem-5.10 vulnerabilities","details":"Ilja Van Sprundel discovered that the SCTP implementation in the Linux\nkernel did not properly perform size validations on incoming packets in\nsome situations. An attacker could possibly use this to expose sensitive\ninformation (kernel memory). (CVE-2021-3655)\n\nIt was discovered that the AMD Cryptographic Coprocessor (CCP) driver in\nthe Linux kernel did not properly deallocate memory in some error\nconditions. A local attacker could use this to cause a denial of service\n(memory exhaustion). (CVE-2021-3744, CVE-2021-3764)\n\nIt was discovered that the NFC subsystem in the Linux kernel contained a\nuse-after-free vulnerability in its NFC Controller Interface (NCI)\nimplementation. A local attacker could possibly use this to cause a denial\nof service (system crash) or execute arbitrary code. (CVE-2021-3760)\n\nIt was discovered that an integer overflow could be triggered in the eBPF\nimplementation in the Linux kernel when preallocating objects for stack\nmaps. A privileged local attacker could use this to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2021-41864)\n\nIt was discovered that the KVM implementation for POWER8 processors in the\nLinux kernel did not properly keep track if a wakeup event could be\nresolved by a guest. An attacker in a guest VM could possibly use this to\ncause a denial of service (host OS crash). (CVE-2021-43056)\n\nIt was discovered that the ISDN CAPI implementation in the Linux kernel\ncontained a race condition in certain situations that could trigger an\narray out-of-bounds bug. A privileged local attacker could possibly use\nthis to cause a denial of service or execute arbitrary code.\n(CVE-2021-43389)\n","modified":"2026-02-10T04:42:23Z","published":"2021-11-11T05:32:20Z","related":["UBUNTU-CVE-2021-3655","UBUNTU-CVE-2021-3744","UBUNTU-CVE-2021-3760","UBUNTU-CVE-2021-3764","UBUNTU-CVE-2021-41864","UBUNTU-CVE-2021-43056","UBUNTU-CVE-2021-43389"],"upstream":["CVE-2021-3655","CVE-2021-3744","CVE-2021-3760","CVE-2021-3764","CVE-2021-41864","CVE-2021-43056","CVE-2021-43389","UBUNTU-CVE-2021-3655","UBUNTU-CVE-2021-3744","UBUNTU-CVE-2021-3760","UBUNTU-CVE-2021-3764","UBUNTU-CVE-2021-41864","UBUNTU-CVE-2021-43056","UBUNTU-CVE-2021-43389"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5139-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-3655"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-3744"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-3760"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-3764"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-41864"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-43056"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-43389"}],"affected":[{"package":{"name":"linux-oem-5.10","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/linux-oem-5.10@5.10.0-1051.53?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-1051.53"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52"],"ecosystem_specific":{"binaries":[{"binary_version":"5.10.0-1051.53","binary_name":"linux-buildinfo-5.10.0-1051-oem"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-headers-5.10.0-1051-oem"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-image-unsigned-5.10.0-1051-oem"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-modules-5.10.0-1051-oem"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-oem-5.10-headers-5.10.0-1051"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-oem-5.10-tools-5.10.0-1051"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-oem-5.10-tools-host"},{"binary_version":"5.10.0-1051.53","binary_name":"linux-tools-5.10.0-1051-oem"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5139-1.json","cves_map":{"cves":[{"id":"CVE-2021-3655","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-3744","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2021-3760","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-3764","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-41864","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2021-43056","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-43389","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:20.04:LTS"}}}],"schema_version":"1.7.3"}