Netapp Solidfire Baseboard Management Controller vulnerabilities

34 CVEs affecting Netapp Solidfire Baseboard Management Controller, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-41073, published 2021-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability, published 2021-07-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.7% chance of exploitation in the next 30 days. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through…
CVE-2019-19447, published 2019-12-08. High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days. In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to…
CVE-2019-19377, published 2019-11-29. High severity, CVSS 7.8. EPSS: 3.4% chance of exploitation in the next 30 days. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
CVE-2020-29573, published 2020-12-06. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long…
CVE-2021-41073, published 2021-09-19. High severity, CVSS 7.8. EPSS: 1.8% chance of exploitation in the next 30 days. loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by…
CVE-2020-27786, published 2020-12-11. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue.…
CVE-2021-26708, published 2021-02-05. High severity, CVSS 7.0. EPSS: 1.6% chance of exploitation in the next 30 days. A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The…
CVE-2019-19922, published 2019-12-22. Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days. kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by…
CVE-2019-15218, published 2019-08-19. Medium severity, CVSS 4.6. EPSS: 0.8% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.
CVE-2020-12464, published 2020-04-29. Medium severity, CVSS 6.7. EPSS: 0.8% chance of exploitation in the next 30 days. usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.

Latest

CVE-2021-40490, published 2021-09-03. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.
CVE-2021-28691, published 2021-06-29. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with…
CVE-2021-33200, published 2021-05-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and…
CVE-2020-25669, published 2021-05-26. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in…
CVE-2020-25221, published 2020-09-10. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page…