High severity · published Mar 7, 2021
CVE-2021-27365
An issue was discovered in the Linux kernel through 5.11.3
7.8
CVSS
2.1%
EPSS
No
On KEV
Description
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
before 4.4.260; 4.5 before 4.9.260; 4.10 before 4.14.224; 4.15 before 4.19.179; 4.20 before 5.4.103; 5.5 before 5.10.21; +1 more · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
SB
Solidfire Baseboard Management Controller Firmware · Netapp
All versions, or not specified · source: NVD
TP
Tekelec Platform Distribution · Oracle
7.4.0 through 7.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27365
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27365
Third Party Advisory
http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
Exploit
https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1182715
Mailing List
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7ee
Mailing List
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5
Mailing List
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability