CVE-2021-4115

説明

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned.

CVSS (Common Vulnerability Scoring System) のスコアの詳細

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 スコアの内訳

Red HatNVDcve.org
ベーススコア6.25.5N/A
攻撃ベクトルLocalLocalN/A
攻撃の複雑さLowLowN/A
必要な権限NoneLowN/A
ユーザー関与レベルNoneNoneN/A
範囲UnchangedUnchangedN/A
機密性NoneNoneN/A
完全性への影響NoneNoneN/A
可用性への影響HighHighN/A

ベクトル

Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

脆弱性の原因 (CWE) の理解

Confidentiality,Integrity

Technical Impact: Read Application Data; Modify Application Data

謝辞

Red Hat would like to thank Kevin Backhouse for reporting this issue.

よくある質問

エラータ通知の受信を希望しますか? こちらで登録してください