Vulnerability · Published Mar 9, 2022 · Assigned by redhat

CVE-2021-20269

Medium 5.5

In plain English

A medium-severity incorrect default permissions in kexec-tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Rocky Linux:8	kexec-tools	0:2.0.20-57.el8	RLSA-2021:4404

Affected products (as reported)

Vendor	Product	Versions
n/a	kexec-tools	Fedora kexec-tools versions prior to 2.0.21-8 and RHEL kexec-tools versions prior to 2.0.20-47

Weakness: CWE-276

References

https://bugzilla.redhat.com/show_bug.cgi?id=1934261 x_refsource_MISC