CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability
A flaw was discovered in processing setsockopt IPTSOSETREPLACE (or IP6TSOSETREPLACE) for 32 bit processes on 64 bit systems. This flaw will allow local user to gain privileges or cause a DoS through user name space. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated privileges.
Other sources
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
— CISA
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a heap out-of-bounds write flaw in net/netfilter/xtables.c. By sending a specially-crafted request through user name space, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause a denial of service condition.
— IBM
Affected Software
Remediation
Information
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22555?
CVE-2021-22555 is a heap out-of-bounds write vulnerability affecting Linux kernel since v2.6.19-rc1 in the net/netfilter/x_tables component.
How does CVE-2021-22555 affect the system?
CVE-2021-22555 allows a local user to gain privileges or cause a denial-of-service (DoS) through user name space.
Which software versions are affected by CVE-2021-22555?
Linux kernel versions between v2.6.19-rc1 and 5.12 are affected by CVE-2021-22555.
What is the severity of CVE-2021-22555?
CVE-2021-22555 has a severity rating of 7.8 (High).
How can I fix CVE-2021-22555?
To fix CVE-2021-22555, update the Linux kernel to version 5.12 or apply the appropriate patches as recommended by the vendor.