Security readout for executives and security teams
Plain-English summary
This is a narrow Linux kernel denial-of-service issue on PowerPC systems. If an untrusted local user can access a vulnerable kernel configured with very permissive perf access, they may be able to crash kernel execution through the perf subsystem. It is not described as remote code execution or data theft.
Executive priority
Prioritize remediation for shared PowerPC systems, labs, or hosting environments with untrusted local users. For ordinary server fleets without PowerPC exposure or permissive perf settings, urgency is lower.
Technical view
The flaw is in arch/powerpc/perf/core-book3s.c before Linux 5.12.13. With perf_event_paranoid set to -1 and no specific PMU driver support registered, a local user can trigger a NULL pointer dereference in perf_instruction_pointer, causing an OOPS.
Likely exposure
Exposure appears limited to PowerPC Linux systems running kernels before 5.12.13, especially where perf_event_paranoid is -1 and PMU driver support is absent. General x86 Linux fleets are not indicated by the provided sources.
Exploitation context
The sources describe local denial of service through perf usage. They do not show active exploitation, public weaponization, KEV listing, privilege escalation, remote access, or data compromise.
Researcher notes
The available record lacks CVSS, CWE, detailed affected product metadata, and vendor-specific backport information. Treat the upstream Linux commit and 5.12.13 changelog as the primary remediation anchors.
Mitigation direction
- Upgrade to Linux 5.12.13 or a vendor kernel containing the referenced fix.
- Avoid setting perf_event_paranoid to -1 on shared or untrusted systems.
- Restrict local shell access on affected PowerPC hosts until remediated.
- Check distribution or hardware vendor guidance for backported kernel fixes.
Validation and detection
- Inventory PowerPC Linux systems and identify kernel versions before 5.12.13.
- Review whether perf_event_paranoid is configured as -1.
- Confirm whether affected hosts lack specific PMU driver support.
- Verify vendor kernel changelogs for the referenced upstream fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38200 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/torvalds/linux/commit/60b7ed54a41b550d50caf7f2418db4a7e75b5bdcCVE reference · x_refsource_MISC
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.