Type Vulnerability
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
Linux · Memory corruption
Linux Kernel Heap Out-of-Bounds Write Vulnerability
CVE-2021-22555
What this means
This is rated high severity (8.3 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Netapp c400 Firmware, Netapp c400 and Netapp c250 Firmware, and 33 more are in your estate, and treat that as the priority.
Full vendor description
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
Scoring and exploitation
8.3/ 10
CVSS 3.1 base scoreHigh
Exploitable from the same local network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorAdjacentAV:A
Attack complexityHighAC:H
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~78.7% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Linux Kernel
Weaknesses
CWE-787
Affected products ()
- Netapp c400 Firmware
- Netapp c400
- Netapp c250 Firmware
- Netapp c250
- Netapp h410c Firmware
- Netapp h410c
- Netapp h300s Firmware
- Netapp h300s
- Netapp h500s Firmware
- Netapp h500s
- Netapp h700s Firmware
- Netapp h700s
- Netapp h410s Firmware
- Netapp h410s
- Linux Linux Kernel
- Broadcom Fabric Operating System
- Netapp Fas 8300 Firmware
- Netapp Fas 8300
- Netapp Fas 8700 Firmware
- Netapp Fas 8700
- Netapp Aff a400 Firmware
- Netapp Aff a400
- Netapp Aff a250 Firmware
- Netapp Aff a250
- Netapp Aff 500f Firmware
- Netapp Aff 500f
- Netapp h610c Firmware
- Netapp h610c
- Netapp h610s Firmware
- Netapp h610s
- Netapp h615c Firmware
- Netapp h615c
- Netapp Cloud Backup
- Netapp Hci Management Node
- Netapp Solidfire
- Netapp Solidfire Baseboard Management Controller
Show the raw CPE strings (36)
- cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:c400:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
Showing 25 of 36 matches from .
References
19 links from the CVE record, grouped by site; the vendor's advisory comes first.
git.kernel.org2 linksVendor advisory
- x_tables.c (opens in a new tab)Mailing List · Patch · Vendor Advisory
- x_tables.c (opens in a new tab)Mailing List · Patch · Vendor Advisory
packetstormsecurity.com5 links
- Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html (opens in a new tab)Third Party Advisory · VDB Entry
- Kernel-Live-Patch-Security-Notice-LSN-0080-1.html (opens in a new tab)Exploit · Third Party Advisory · VDB Entry
- Kernel-Live-Patch-Security-Notice-LSN-0081-1.html (opens in a new tab)Exploit · Third Party Advisory · VDB Entry
Show 2 more from packetstormsecurity.com
- Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html (opens in a new tab)Exploit · Third Party Advisory · VDB Entry
- Kernel-Live-Patch-Security-Notice-LSN-0083-1.html (opens in a new tab)Exploit · Third Party Advisory · VDB Entry
github.com1 link
- GHSA-xxx5-8mvq-3528 (opens in a new tab)Exploit · Third Party Advisory
security.netapp.com1 link
- ntap-20210805-0010 (opens in a new tab)Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource