CVE-2021-3714

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	kernel	Not known

References

https://access.redhat.com/security/cve/CVE-2021-3714Third Party Advisory
https://arxiv.org/abs/2111.08553Third Party Advisory
https://arxiv.org/pdf/2111.08553.pdfTechnical Description, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1931327Issue Tracking, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-3714Third Party Advisory
https://arxiv.org/abs/2111.08553Third Party Advisory
https://arxiv.org/pdf/2111.08553.pdfTechnical Description, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1931327Issue Tracking, Third Party Advisory

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-371449.1CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect CVE-2021-371457.2A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker CVE-2021-371467.5An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers CVE-2021-371477.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-371487.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-371497.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-37157.8A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled chang CVE-2021-371507.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issu CVE-2021-371515.3CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain aut CVE-2021-371525.4Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files CVE-2021-371539.8ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass iss CVE-2021-371549.8In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0