HOME VULNERABILITIESCVE-2021-27365

HIGH

CVE-2021-27365

CWE-787Published: March 7, 2021· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.

Technical Analysis

CVE-2021-27365 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Debian1 product(s)

debian linux

Linux1 product(s)

linux kernel

netapp2 product(s)

solidfire baseboard management controller firmwaresolidfire baseboard management controller

Oracle1 product(s)

tekelec platform distribution

Source: NVD CPE · 5 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7ee

PATCHhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5

PATCHhttps://www.oracle.com/security-alerts/cpuoct2021.html

PATCHhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7ee

PATCHhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5

PATCHhttps://www.oracle.com/security-alerts/cpuoct2021.html

ADVISORYhttp://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html

ADVISORYhttps://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html

ADVISORYhttps://bugzilla.suse.com/show_bug.cgi?id=1182715

ADVISORYhttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2021/03/msg00035.html

ADVISORYhttps://security.netapp.com/advisory/ntap-20210409-0001/

ADVISORYhttps://www.openwall.com/lists/oss-security/2021/03/06/1

ADVISORYhttp://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html

ADVISORYhttps://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html

ADVISORYhttps://bugzilla.suse.com/show_bug.cgi?id=1182715

ADVISORYhttps://lists.debian.org/debian-lts-announce/2021/03/msg00010.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2021/03/msg00035.html

ADVISORYhttps://security.netapp.com/advisory/ntap-20210409-0001/

ADVISORYhttps://www.openwall.com/lists/oss-security/2021/03/06/1

All References (20)

→

http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlThird Party Advisory · VDB Entry

→

https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.htmlExploit · Third Party Advisory

→

https://bugzilla.suse.com/show_bug.cgi?id=1182715Issue Tracking · Third Party Advisory

→

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7eeMailing List · Patch · Vendor Advisory

→

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5Mailing List · Patch · Vendor Advisory

→

https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List · Third Party Advisory

→

https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlMailing List · Third Party Advisory

→

https://security.netapp.com/advisory/ntap-20210409-0001/Third Party Advisory

→

https://www.openwall.com/lists/oss-security/2021/03/06/1Mailing List · Third Party Advisory

→

https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch · Third Party Advisory

→

http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlThird Party Advisory · VDB Entry

→

https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.htmlExploit · Third Party Advisory

→

https://bugzilla.suse.com/show_bug.cgi?id=1182715Issue Tracking · Third Party Advisory

→

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec98ea7070e94cc25a422ec97d1421e28d97b7eeMailing List · Patch · Vendor Advisory

→

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5Mailing List · Patch · Vendor Advisory

Quick Facts

CVE IDCVE-2021-27365

CVSS Score7.8 / 10

SeverityHIGH

WeaknessCWE-787

CISA KEVNo

Affected4 vendor(s)

PublishedMar 7, 2021

Related CVEs (CWE-787)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2021-27365 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2021-27365·NVD