CVE-2021-22600
HIGH CISA KEV
Published Jan 26, 20224y ago · Modified Jun 17, 20262w ago
7.0 CVSS 3.1
Published Jan 26, 2022 4y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Apr 11, 2022 4y ago
KEV Due May 2, 2022 1526d overdue
Description
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
CISA Known Exploited Overdue 1526d
- Added
- Apr 11, 2022
- Due
- May 2, 2022
Apply updates per vendor instructions.
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available
Weaknesses 1
CWE-415
Affected Products 25
| Vendor | Product | Version | Range |
|---|---|---|---|
| netapp | 8300_firmware | * | any |
| netapp | 8300 | * | any |
| netapp | 8700_firmware | * | any |
| netapp | 8700 | * | any |
| netapp | a400_firmware | * | any |
| netapp | a400 | * | any |
| netapp | c400_firmware | * | any |
| netapp | c400 | * | any |
| linux | linux_kernel | * | ≥4.14.175 – <4.14.259 |
| linux | linux_kernel | * | ≥4.19.114 – <4.19.222 |
| linux | linux_kernel | * | ≥5.4.29 – <5.4.168 |
| linux | linux_kernel | * | ≥5.5.14 – <5.10.88 |
| linux | linux_kernel | * | ≥5.11 – <5.15.11 |
| debian | debian_linux | 9.0 | any |
| debian | debian_linux | 10.0 | any |
| netapp | h410c_firmware | * | any |
| netapp | h410c | * | any |
| netapp | h300s_firmware | * | any |
| netapp | h300s | * | any |
| netapp | h500s_firmware | * | any |
| netapp | h500s | * | any |
| netapp | h700s_firmware | * | any |
| netapp | h700s | * | any |
| netapp | h410s_firmware | * | any |
| netapp | h410s | * | any |
References 5
- git.kernel.org https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
- lists.debian.org https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- security.netapp.com https://security.netapp.com/advisory/ntap-20230110-0002/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22600
- debian.org https://www.debian.org/security/2022/dsa-5096
Remediation
- git.kernel.org https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=ec6af094ea28f0f2dda1a6a33b14cd57e36a9755