CRITICAL 9.8 Microsoft PoC
CVE-2021-43267
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
Microsoft Security Update 2021-Nov: An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
Affected Products
- cm1 kernel 5.10.78.1-1 on CBL Mariner 1.0
- cbl2 kernel 5.10.78.1-1 on CBL Mariner 2.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43267
- https://nvd.nist.gov/vuln/detail/CVE-2021-43267
This critical severity vulnerability with a CVSS score of 9.8 was published on 2021-11-09 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 57.6% (top 1% of all CVEs by exploitation probability). Affected: cm1 kernel 5.10.78.1-1 on CBL Mariner 1.0, cbl2 kernel 5.10.78.1-1 on CBL Mariner 2.0.
Risk Timeline
CVE Disclosed2021-11-09 · 1745 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
Remediation Resources
Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43267NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2021-43267Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2021-43523 | In uClibc and uClibc-ng before 1.0.39 incorrect handling of special characters i | CRITICAL | 9.6 |
| CVE-2023-25725 PoC | HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers | CRITICAL | 9.1 |
| CVE-2020-25632 | A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation al | HIGH | 8.2 |
| CVE-2021-3935 | When PgBouncer is configured to use "cert" authentication a man-in-the-middle at | HIGH | 8.1 |
| CVE-2021-3968 | Heap-based Buffer Overflow in vim/vim | HIGH | 8.0 |
| CVE-2020-12657 | An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-f | HIGH | 7.8 |
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.