CVE-2021-22556

published 2022-05-03

CVE-2021-22556: The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that…

Priority P3 39 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
google	fuchsia	< 4.1	4.1
google_llc	fuchsia_kernel	>= unspecified < 4.1	4.1

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-190