Vulnerability · Published Mar 11, 2021 · Assigned by redhat
CVE-2021-20261
Medium 6.4
In plain English
A medium-severity race condition in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 4.5.1-1 | DEBIAN-CVE-2021-20261 |
| Debian:13 | linux | 4.5.1-1 | DEBIAN-CVE-2021-20261 |
| Debian:14 | linux | 4.5.1-1 | DEBIAN-CVE-2021-20261 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2021-20261 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2021-20261 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2021-20261 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2021-20261 |
Affected products (as reported)
Weakness: CWE-362