CVE-2021-3753 is a race condition vulnerability in the Linux kernel's vt_k_ioctl function, specifically affecting drivers/tty/vt/vt_ioctl.c. This flaw can lead to an out-of-bounds read due to unprotected write access to vc_mode during KDSETMDE operations, impacting products like Linux, NetApp, and Red Hat. The vulnerability has a CVSS score of 4.7 (MEDIUM), indicating a local attack vector with high attack complexity and a primary impact on data confidentiality. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and it is not listed in the CISA KEV catalog. Community discussion and media coverage are minimal, suggesting low public awareness and exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.
Feb 8, 2022kernel: a race out-of-bound read in vt
Sep 1, 2021