{"id":"CVE-2021-22555","kind":"vulnerability","aliases":["CVE-2021-22555"],"related":[],"title":"A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c","description":"Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A heap out-of-bounds write in the Linux kernel's netfilter code can corrupt kernel memory when a local user creates a user namespace. An attacker with a local account can gain root privileges or crash the machine, and CISA lists it as actively exploited.","severity":"high","cvss":8.3,"epss":null,"exploited":true,"exploited_at":"2025-10-06T00:00:00+00:00","products":[{"name":"netapp c400 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp c250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.4.267"],"affected":">= 2.6.19, < 4.4.267","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.9.267"],"affected":">= 4.5, < 4.9.267","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.14.231"],"affected":">= 4.10, < 4.14.231","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.19.188"],"affected":">= 4.15, < 4.19.188","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.4.113"],"affected":">= 4.20, < 5.4.113","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.31"],"affected":">= 5.5, < 5.10.31","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.12"],"affected":">= 5.11, < 5.12","ecosystem":"vendor"},{"name":"broadcom fabric operating system","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp fas 8300 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp fas 8700 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp aff a400 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp aff a250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp aff 500f firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h610c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h610s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h615c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp cloud backup","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp hci management node","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp solidfire","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp solidfire baseboard management controller","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","multi-user-hosts","self-hosted"],"not_affected_if":["managed-hosting","user-namespaces-disabled"],"how_to_check":"uname -r\nCheck your distro's kernel advisory for CVE-2021-22555 against your installed kernel build","fix":"Upgrade to a patched kernel from your distribution (version unknown from the sources), then reboot.\nIf you cannot patch, follow CISA's BOD 22-01 guidance or the vendor's mitigation instructions.","status":"open","published_at":"2021-07-07T12:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:39+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:44:39Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a patched kernel from your distribution (version unknown from the sources), then reboot.\nIf you cannot patch, follow CISA's BOD 22-01 guidance or the vendor's mitigation instructions.","reach":"local","summary":"A heap out-of-bounds write in the Linux kernel's netfilter code can corrupt kernel memory when a local user creates a user namespace. An attacker with a local account can gain root privileges or crash the machine, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["linux","self-hosted","multi-user-hosts","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local user gains root and can read any secret on the machine.","analyst_note":"Find the fixed kernel versions and the sysctl or mitigation that disables unprivileged user namespaces, from the NVD entry or your distro's CVE tracker.","how_to_check":"uname -r\nCheck your distro's kernel advisory for CVE-2021-22555 against your installed kernel build\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","user-namespaces-disabled"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2541,"output_tokens":445,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':207C '-2021':17A,20A '-22555':18A,21A '22':206C '500f':79A '8300':63A '8700':67A 'a250':75A 'a400':71A 'account':148B 'action':197C 'activ':162B 'aff':70A,74A,78A 'affect':8A 'allow':177C 'appli':198C 'applic':204C 'attack':144B,179C 'backup':92A 'baseboard':101A 'bod':205C 'bound':6A,122B,172C 'broadcom':57A 'c250':26A 'c400':23A 'caus':184C 'cisa':158B,195C 'cloud':91A,210C 'code':130B 'contain':166C 'controller':103A 'corrupt':132B,190C 'could':176C 'crash':154B 'creat':139B 'cve':16A,19A 'discontinu':213C 'discov':13A 'dos':186C 'exploit':106B,163B 'fabric':58A 'fas':62A,66A 'firmware':24A,27A,30A,33A,36A,39A,42A,64A,68A,72A,76A,80A,83A,86A,89A 'follow':203C 'gain':150B,181C 'guidanc':208C 'h300s':32A 'h410c':29A 'h410s':41A 'h500s':35A 'h610c':82A 'h610s':85A 'h615c':88A 'h700s':38A 'hci':94A 'heap':2A,118B,168C,188C 'host':113B,116B 'infrastructur':107B 'instruct':202C 'kernel':44A,46A,48A,50A,52A,54A,56A,105A,127B,133B,165C 'kubernet':108B 'linux':9A,43A,45A,47A,49A,51A,53A,55A,104A,109B,126B,164C 'list':159B 'local':137B,147B 'machin':156B 'management':95A,102A 'memori':134B,189C 'mitig':199C,219C 'multi':111B 'multi-user-host':110B 'name':193C 'namespac':142B 'net/netfilter/x_tables.c':15A 'netapp':22A,25A,28A,31A,34A,37A,40A,61A,65A,69A,73A,77A,81A,84A,87A,90A,93A,97A,99A 'netfilt':129B 'node':96A 'operating':59A 'out-of-bound':3A,119B,169C 'per':200C 'privileg':152B,182C 'product':217C 'requir':196C 'root':151B 'self':115B 'self-host':114B 'servic':211C 'sinc':10A 'solidfire':98A,100A 'space':194C 'system':60A 'unavail':221C 'use':214C 'user':112B,138B,141B,192C 'v2.6.19-rc1':11A 'vendor':201C 'via':187C 'vulner':174C 'write':7A,123B,173C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-07-07T12:15:08+00:00","kev":{"dateAdded":"2025-10-06","dueDate":"2025-10-27","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve-coordination@google.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22555","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22555","severity":null,"published_at":"2025-10-06T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22555","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22555","severity":null,"published_at":"2021-07-07T12:15:08+00:00","modified_at":"2026-10-13T18:25:34+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}