Skip to content
OpenAdvisories
Unscored CVE-2021-39636 EUVD-2021-25993GHSA-35xq-5wph-pxqw

In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This cou…

Published Dec 15, 2021 · Updated Aug 4, 2024 · Assigned by google_android

Package: linux Package: linux Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-azure Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-edge Package: linux-azure-fde-5.15 Package: linux-fips Package: linux-gcp Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gke-4.15 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.8 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-kvm Package: linux-lts-xenial Package: linux-oem Package: linux-oem-5.6 Package: linux-oracle-5.0 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.8 Package: linux-snapdragon Package: linux-vmware Platform: Android Ecosystem: Debian Ecosystem: Ubuntu

Description

In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-120612905References: Upstream kernel

Affected products

VendorProductAffectedFixed
— Android Android kernel —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 4.16.5-1 —
Debian 13 linux 4.16.5-1 —
Debian 12 linux 4.16.5-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-realtime +1 No fix yet —
Ubuntu 20.04 LTS linux-riscv +10 No fix yet —
Ubuntu 18.04 LTS linux 4.15.0-24.26 —
Ubuntu 18.04 LTS linux-aws 4.15.0-1011.11 —
Ubuntu 18.04 LTS linux-gcp +11 No fix yet —
Ubuntu 18.04 LTS linux-kvm 4.15.0-1012.12 —
Ubuntu 18.04 LTS linux-raspi2 4.15.0-1013.14 —
Ubuntu 18.04 LTS linux-snapdragon 4.15.0-1053.57 —
Ubuntu 16.04 LTS linux-gcp +1 4.15.0-1014.14~16.04.1 —
Ubuntu 16.04 LTS linux-hwe 4.15.0-24.26~16.04.1 —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips 4.4.0-1073.79 —
Ubuntu Pro 20.04 LTS linux-azure-fde-5.15 5.15.0-1114.123~20.04.1 —
Ubuntu Pro 16.04 LTS linux 4.4.0-223.256 USN-5361-1
Ubuntu Pro 16.04 LTS linux-aws 4.4.0-1139.153 USN-5361-1
Ubuntu Pro 16.04 LTS linux-kvm 4.4.0-1104.113 USN-5361-1
Ubuntu Pro 14.04 LTS linux No fix yet —
Ubuntu Pro 14.04 LTS linux-aws 4.4.0-1103.108 USN-5361-1
Ubuntu Pro 14.04 LTS linux-lts-xenial 4.4.0-223.256~14.04.1 USN-5361-1

Advisories 1

References