CVE-2021-22555: high-severity vulnerability in Linux Kernel
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Linux's network filtering system allows attackers to write data beyond the bounds of allocated memory, potentially gaining unauthorized access or crashing the system. This vulnerability affects the kernel's ability to safely handle network rule configurations.
A heap out-of-bounds write in net/netfilter/x_tables.c (CWE-787) enables privilege escalation or denial of service through heap memory corruption. The vulnerability is triggered via the IP6T_SO_SET_REPLACE socket option in user namespace context, affecting Linux kernels from v2.6.19-rc1 onwards.
The full analysis of this CVE is available in Portuguese →