This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-21781 →

DEBIAN-CVE-2021-21781

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) see...

Original description

The description as published by the source.

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.19-1"}]}]

Debian:13 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.19-1"}]}]

Debian:14 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.19-1"}]}]

References

advisory security-tracker.debian.org