PT-2022-9252 · Linux · Linux Kernel

Published 2022-05-03 · Updated 2022-05-11 · CVE-2021-22556

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.1

Description The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace.

Recommendations For Linux kernel versions prior to 4.1, upgrade to kernel version 4.1 or beyond to resolve the issue.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2021-22556

Affected Products

Linux Kernel

References · 6

• https://fuchsia-review.googlesource.com/c/fuchsia/+/570881 · Patch
• https://osv.dev/vulnerability/CVE-2021-22556 · Vendor Advisory
• https://fuchsia.dev/whats-new/release-notes/f4-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22556 · Security Note
• https://t.me/cibsecurity/41828 · Telegram Post
• https://t.me/cvenotify/29992 · Telegram Post