CVE-2021-22556 Integer Overflow in Fuchsia Kernel

What is CVE-2021-22556?

CVE-2021-22556 is a medium-severity vulnerability in Google LLC Fuchsia Kernel, published on 3 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.

Weakness: CWE-190

Which versions are affected by CVE-2021-22556?

It affects 1 product.

Products include Google Fuchsia.

How do I fix CVE-2021-22556?

No fix has been published for CVE-2021-22556 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22556 being exploited?

There is no known exploitation of CVE-2021-22556 in the wild and no public exploit code.

Other vulnerabilities in Google LLC Fuchsia Kernel

• CVE-2022-0247 Write access to VMO data through copy-on-write in Fuchsia High 7.5
• CVE-2024-10604 Identifiable Header Values In Fuchsia Leading To Tracking of The User Medium 6.9
• CVE-2022-0882 Illegal access to Kernel log in Fuchsia Medium 5.3
• CVE-2021-22566 Incorrect mapping of Executable bits in Fuchsia Kernel Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cgfp-g9xr-gj33.