CVE-2021-42252High· 7.8▾ TwilightAn issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potential…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
cloud_backuplinux_kernel >= 4.12, < 4.14.247linux_kernel >= 4.15, < 4.19.207linux_kernel >= 4.20, < 5.4.148linux_kernel >= 5.5, < 5.10.67linux_kernel >= 5.11, < 5.13.19linux_kernel >= 5.14, < 5.14.6h300s_firmwareh500s_firmwareh700s_firmwareh300e_firmwareh500e_firmwareh700e_firmwareh410s_firmwareh410c_firmwaresolidfire_baseboard_management_controller_firmwareUpgrade past the affected range:
linux_kernel 5.14.6Connected by shared product, vendor, weakness, or advisory.
CVE-2021-22555High· 8.3A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c
CVE-2021-43975Medium· 6.7In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length v…
CVE-2020-24486Medium· 5.5Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.
CVE-2020-28097Medium· 5.9The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback
CVE-2020-8670Medium· 6.4Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-8700Medium· 6.7Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.