Vulnerability · Published May 3, 2022 · Assigned by Google
CVE-2021-22556Integer Overflow in Fuchsia Kernel
Medium 5.3
In plain English
A medium-severity integer overflow in Fuchsia Kernel from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Fuchsia Kernel | unspecified – before 4.1 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://fuchsia.dev/whats-new/release-notes/f4-1 x_refsource_MISC
- https://fuchsia-review.googlesource.com/c/fuchsia/+/570881 x_refsource_MISC