CVE-2021-37159

Public on 2021-07-21

Modified on 2021-11-04

Description

A flaw use-after-free in the Linux kernel USB High Speed Mobile Devices functionality was found in the way user detaches USB device. A local user could use this flaw to crash the system or escalate their privileges on the system.

Severity

Medium

See what this means

CVSS v3 Base Score

6.4

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 2 - Core	kernel	2021-10-28 23:22	ALAS2-2021-1719
Amazon Linux 2 - Kernel-5.10 Extra	kernel	2022-01-20 23:43	ALAS2KERNEL-5.10-2022-004
Amazon Linux 2 - Microvm-kernel-4.14 Extra	microvm-kernel	2023-09-14 04:27	ALAS2MICROVM-KERNEL-4.14-2023-001

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	6.4	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	CVSSv2	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P
NVD	CVSSv3	6.4	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Red Hat: CVE-2021-37159 Mitre: CVE-2021-37159 FAQs regarding Amazon Linux ALAS/CVE Severity