CVE-2021-35039

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/07/06/3Mailing List, Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.14Mailing List, Patch, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75Mailing List, Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/0c18f29aae7ce3dadd26d8ee3505d07cc982df75Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210813-0004/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/07/06/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/07/06/3Mailing List, Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.14Mailing List, Patch, Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75Mailing List, Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/0c18f29aae7ce3dadd26d8ee3505d07cc982df75Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210813-0004/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/07/06/3Mailing List, Third Party Advisory

Timeline

Published: Jul 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-35045.4A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. CVE-2021-350417.5The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send CVE-2021-350429.8Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w CVE-2021-350436.1OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstra CVE-2021-350456.1Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ en CVE-2021-350466.1A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted s CVE-2021-350478.8Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level acce CVE-2021-350489.8Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerabilit CVE-2021-350498.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerabil CVE-2021-35055.5A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in CVE-2021-350507.5User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access CVE-2021-350527.8A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.