CVE-2021-22556

low-risk

Published 2022-05-03

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

LOCAL / HIGH complexity

Affected Products (1)

Fuchsia

Affected Vendors

Google

References (4)

Issue Tracking https://fuchsia-review.googlesource.com/c/fuchsia/+/570881

Release Notes https://fuchsia.dev/whats-new/release-notes/f4-1

Issue Tracking https://fuchsia-review.googlesource.com/c/fuchsia/+/570881

Release Notes https://fuchsia.dev/whats-new/release-notes/f4-1

/ 100

low-risk

Severity 14/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal