OESA-2021-1429 (CVE-2021-3896)

Vulnerability from osv_openeuler – Published: 2021-11-12 11:04 – Updated: 2026-08-06 11:04 – Source website
VLAI
Summary
kernel security update
Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

An improper validation of an array index and out of bounds memory read in the Linux kernel s Integrated Services Digital Network (ISDN) functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this flaw to crash the system or starve the resources causing denial of service.(CVE-2021-3896)

A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.(CVE-2021-3760)

A flaw was found in the Linux kernel s CAPI over Bluetooth connection code. An attacker with a local account can escalate privileges when CAPI (ISDN) hardware connection fails.(CVE-2021-34981)

Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150(CVE-2020-3702)

UAF in Android ION memory allocator.(CVE-2021-0929)

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.(CVE-2021-20322)

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.(CVE-2021-20320)

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.(CVE-2021-43389)

Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released.(CVE-2020-16119)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bpftool-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-tools-devel-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-tools-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "perf-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-devel-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python2-perf-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "perf-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-tools-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-debugsource-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-source-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python2-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python3-perf-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python3-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "bpftool-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm"
        ],
        "src": [
          "kernel-4.19.90-2111.3.0.0121.oe1.src.rpm"
        ],
        "x86_64": [
          "kernel-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python3-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "perf-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-devel-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python2-perf-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-tools-devel-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python3-perf-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python2-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-tools-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "perf-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-tools-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "bpftool-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "bpftool-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-debugsource-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-source-4.19.90-2111.3.0.0121.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.90-2111.3.0.0121.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perf-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "perf-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-tools-devel-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-tools-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python2-perf-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-tools-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "bpftool-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-devel-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python2-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-source-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "bpftool-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python3-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "python3-perf-4.19.90-2111.3.0.0121.oe1.aarch64.rpm",
          "kernel-debugsource-4.19.90-2111.3.0.0121.oe1.aarch64.rpm"
        ],
        "src": [
          "kernel-4.19.90-2111.3.0.0121.oe1.src.rpm"
        ],
        "x86_64": [
          "python2-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-source-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-devel-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-tools-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-tools-devel-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python2-perf-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "bpftool-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python3-perf-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "python3-perf-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-debugsource-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-tools-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "perf-debuginfo-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "perf-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "bpftool-4.19.90-2111.3.0.0121.oe1.x86_64.rpm",
          "kernel-4.19.90-2111.3.0.0121.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP2",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.90-2111.3.0.0121.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nAn improper validation of an array index and out of bounds memory read in the Linux kernel s Integrated Services Digital Network (ISDN) functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this flaw to crash the system or starve the resources causing denial of service.(CVE-2021-3896)\r\n\r\nA flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.(CVE-2021-3760)\r\n\r\nA flaw was found in the Linux kernel s CAPI over Bluetooth connection code. An attacker with a local account can escalate privileges when CAPI (ISDN) hardware connection fails.(CVE-2021-34981)\r\n\r\nSpecifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic\u0026apos; in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026amp; Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150(CVE-2020-3702)\r\n\r\nUAF in Android ION memory allocator.(CVE-2021-0929)\r\n\r\nA flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.(CVE-2021-20322)\r\n\r\nA flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.(CVE-2021-20320)\r\n\r\nAn issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.(CVE-2021-43389)\n\nUse-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released.(CVE-2020-16119)",
  "id": "OESA-2021-1429",
  "modified": "2026-08-06T11:04:42Z",
  "published": "2021-11-12T11:04:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3896"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3760"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34981"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3702"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0929"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20322"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20320"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43389"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16119"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2021-3896",
    "CVE-2021-3760",
    "CVE-2021-34981",
    "CVE-2020-3702",
    "CVE-2021-0929",
    "CVE-2021-20322",
    "CVE-2021-20320",
    "CVE-2021-43389",
    "CVE-2020-16119"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.