CVE-2021-20269 Information disclosure in kexec-tools
A local unprivileged user can read a log file with incorrect permissions to leak kernel internal information from a previous panic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20269?
CVE-2021-20269 is a medium-severity vulnerability in kexec-tools, published on 9 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.
Weakness: CWE-276
Which versions are affected by CVE-2021-20269?
It affects 1 product.
Linux distribution packages (4)
kexec-tools Red Hat:enterprise_linux:8::baseos | All versions | 0:2.0.20-57.el8 |
kexec-tools-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.0.20-57.el8 |
kexec-tools-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:2.0.20-57.el8 |
kexec-tools Rocky Linux:8 | All versions | 0:2.0.20-57.el8 |
Products include Kexec-Tools Project Kexec-Tools.
How do I fix CVE-2021-20269?
Apply the vendor's patch.
Is CVE-2021-20269 being exploited?
There is no known exploitation of CVE-2021-20269 in the wild and no public exploit code.
Sources
Also known as GHSA-55h9-m2g5-r4xm, OESA-2022-1825, RHSA-2021:4404, RLSA-2021:4404.