CVE-2021-3543

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416 CWE-476

Affected software

Vendor	Product	Versions
n/a	kernel	kernel 4.18.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1953022Issue Tracking, Third Party Advisory
https://lore.kernel.org/lkml/20210429165941.27020-2-andraprs%40amazon.com/
https://bugzilla.redhat.com/show_bug.cgi?id=1953022Issue Tracking, Third Party Advisory
https://lore.kernel.org/lkml/20210429165941.27020-2-andraprs%40amazon.com/

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-354379.8SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.CVE-2021-354386.1phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.CVE-2021-35446.5Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist CVE-2021-354406.1Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's CVE-2021-354487.8Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer CVE-2021-354497.8The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1 CVE-2021-35456.5An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includi CVE-2021-354507.2A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template CVE-2021-354516.1In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web app CVE-2021-354526.5An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.CVE-2021-354569.8Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload CVE-2021-354589.8Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter.