CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability
A flaw was discovered in processing setsockopt IPTSOSETREPLACE (or IP6TSOSETREPLACE) for 32 bit processes on 64 bit systems. This flaw will allow local user to gain privileges or cause a DoS through user name space. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated privileges.
Other sources
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
In xtcompattargetfromuser of xtables.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
— OSV
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
— CISA
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a heap out-of-bounds write flaw in net/netfilter/xtables.c. By sending a specially-crafted request through user name space, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.41.1.rt56.1181.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.41.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-327.100.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-514.92.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.94.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.84.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.56.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.12.1.rt7.84.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.12.1.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.52.1.el8_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.64.1.rt13.115.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.64.1.el8_2 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.3.18-20210903.0.el7_9 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.4.7-20210804.0.el8_4 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 5.12 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2021-10-05 - Configuration
For RHEL 8 systems not using containers, add `user.max_user_namespaces = 0` to a file under `/etc/sysctl.d/` (equivalent immediate change: `echo 0 > /proc/sys/user/max_user_namespaces`), then reload the configuration with `sudo sysctl --system`.
Linux user namespaces user.max_user_namespaces = 0 - Configuration
For containers where user namespaces cannot be disabled, block the `unshare(CLONE_NEWUSER)` and `unshare(CLONE_NEWNET)` syscalls in the seccomp policy.
Seccomp policy blocked syscalls = block unshare(CLONE_NEWUSER) and unshare(CLONE_NEWNET)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22555?
CVE-2021-22555 is a heap out-of-bounds write vulnerability affecting Linux kernel since v2.6.19-rc1 in the net/netfilter/x_tables component.
How does CVE-2021-22555 affect the system?
CVE-2021-22555 allows a local user to gain privileges or cause a denial-of-service (DoS) through user name space.
Which software versions are affected by CVE-2021-22555?
Linux kernel versions between v2.6.19-rc1 and 5.12 are affected by CVE-2021-22555.
What is the severity of CVE-2021-22555?
CVE-2021-22555 has a severity rating of 7.8 (High).
How can I fix CVE-2021-22555?
To fix CVE-2021-22555, update the Linux kernel to version 5.12 or apply the appropriate patches as recommended by the vendor.