CVE-2022-21505 Security feature bypass in Oracle Linux

Medium 6.7 Published 24 Dec 2024 Updated 14 Oct 2026

Attackers with high privileges can bypass kernel lockdown via kexec when IMA appraisal is in log mode and Secure Boot is disabled.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-21505?

CVE-2022-21505 is a medium-severity vulnerability in Oracle Linux, published on 24 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-346

Which versions are affected by CVE-2022-21505?

It affects 1 product.

Products include Oracle Linux.

How do I fix CVE-2022-21505?

Apply the vendor's patch.

Is CVE-2022-21505 being exploited?

There is no known exploitation of CVE-2022-21505 in the wild and no public exploit code.

All Oracle Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-21505, UBUNTU-CVE-2022-21505.