CVE-2021-3714 Information disclosure in kernel
Local attackers can exploit Linux kernel memory deduplication to infer sensitive data by detecting page merging via networked file access times.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3714?
CVE-2021-3714 is a medium-severity vulnerability in Linux kernel, published on 23 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged.
Weakness: CWE-200
Which versions are affected by CVE-2021-3714?
It affects 2 products.
Products include Linux kernel, Redhat Enterprise Linux.
How do I fix CVE-2021-3714?
Apply the vendor's patch.
Is CVE-2021-3714 being exploited?
There is no known exploitation of CVE-2021-3714 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-3714, GHSA-p9ch-h5p3-4xcq, ROOT-OS-DEBIAN-12-CVE-2021-3714, ROOT-OS-DEBIAN-13-CVE-2021-3714, ROOT-OS-UBUNTU-2204-CVE-2021-3714, ROOT-OS-UBUNTU-2404-CVE-2021-3714 and 1 more.