⚠ Actively exploited
Added to CISA KEV on 2022-04-11. Federal agencies required to patch by 2022-05-02. Required action: Apply updates per vendor instructions..

CVE-2021-22600

CWE-415CWE-416 — Use After Free24 documents11 sources
Severity
7.0HIGH
EPSS
0.1%
top 70.38%
CISA KEV
KEV
Added 2022-04-11
Due 2022-05-02
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Linux Kernel KernelLinux Linux KernelDebian Debian Linux
Timeline
PublishedJan 26
KEV addedApr 11
Latest updateMay 1
KEV dueMay 2
CISA Required Action: Apply updates per vendor instructions.

Description

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:HExploitability: 0.8 | Impact: 5.3

Affected Packages22 packages

▶Android:linux_kernel::0 — :2022-05-05
▶NVDlinux/linux_kernel4.14.175 — 4.14.259+4
▶CVEListV5linux_kernel/kernelunspecified — 5.4.168+3
▶Debianlinux< 5.10.92-1+3
▶Ubuntulinux< 4.15.0-169.177+1

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

11
OSV
CVE-2021-22600: In packet_set_ring of af_packet↗2022-05-01
▶
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities↗2022-02-22
▶
OSV
linux, linux-aws, linux-aws-5.13, linux-azure, linux-gcp, linux-kvm, linux-oracle, linux-oracle-5.13, linux-raspi vulnerabilities↗2022-02-22
▶
OSV
linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4 linux-oracle, ↗2022-02-22
▶
OSV
linux vulnerabilities↗2022-02-18
▶

📋Vendor Advisories

12
Android
CVE-2021-22600: Kernel↗2022-05-01
▶
CISA
Linux Kernel Privilege Escalation Vulnerability↗2022-04-11
▶
Ubuntu
Linux kernel vulnerabilities↗2022-02-22
▶
Ubuntu
Linux kernel vulnerabilities↗2022-02-22
▶
Ubuntu
Linux kernel vulnerabilities↗2022-02-22
▶