CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write, actively exploited

Description

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVSS 3.1 breakdown

Attack vectorAdjacent

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Netapp Cloud Backupall versions

Netapp Hci Management Nodeall versions

Netapp Solidfireall versions

Netapp Solidfire Baseboard Management Controllerall versions

Brocade Fabric Operating Systemall versions

Linux Kernel≥ 2.6.19 < 4.4.267 · ≥ 4.10 < 4.14.231 · ≥ 4.15 < 4.19.188 · ≥ 4.20 < 5.4.113

Netapp Aff 500f Firmwareall versions

Netapp Aff A250 Firmwareall versions

Netapp Aff A400 Firmwareall versions

Netapp C250 Firmwareall versions

Netapp C400 Firmwareall versions

Netapp Fas 8300 Firmwareall versions

Netapp Fas 8700 Firmwareall versions

Netapp H300s Firmwareall versions

Netapp H410c Firmwareall versions

Netapp H410s Firmwareall versions

Netapp H500s Firmwareall versions

Netapp H610c Firmwareall versions

Netapp H610s Firmwareall versions

Netapp H615c Firmwareall versions

Netapp H700s Firmwareall versions

Remediation

Fixed in

Linux Kernel≥ 4.4.267

Patch & vendor advisories

References

http://packetstormsecurity.com/files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.htmlExploitThird Party AdvisoryVDB Entry
https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528ExploitThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21Mailing ListPatchVendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801dMailing ListPatchVendor Advisory
https://security.netapp.com/advisory/ntap-20210805-0010/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22555US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-22555 being actively exploited?

Yes. CVE-2021-22555 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 6 Oct 2025.

How severe is CVE-2021-22555?

CVE-2021-22555 has a CVSS 3.1 base score of 8.3, rated high. EPSS estimates a 78.7% probability of exploitation.

Which products are affected by CVE-2021-22555?

Affected products include Netapp Cloud Backup, Netapp Hci Management Node, Netapp Solidfire, Netapp Solidfire Baseboard Management Controller, Brocade Fabric Operating System, and 16 more.

How do I fix CVE-2021-22555?

Upgrade affected software to a fixed version, for example Linux Kernel 4.4.267 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-22555 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo