Vulnerability · Published Aug 24, 2022 · Assigned by redhat

CVE-2021-4155

Medium 5.5

In plain English

A medium-severity security flaw in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.3%top 76.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	kernel-tools-libs-devel	4.18.0-348.12.2.el8_5	ALSA-2022:0188
Debian:12	linux	5.15.15-1	DEBIAN-CVE-2021-4155
Debian:13	linux	5.15.15-1	DEBIAN-CVE-2021-4155
Debian:14	linux	5.15.15-1	DEBIAN-CVE-2021-4155
Rocky Linux:8	kernel	0:4.18.0-348.12.2.el8_5	RLSA-2022:0188
Rocky Linux:8	kernel-rt	0:4.18.0-348.12.2.rt7.143.el8_5	RLSA-2022:0176
Ubuntu:22.04:LTS	linux-intel-iot-realtime	no fix listed	UBUNTU-CVE-2021-4155
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2021-4155
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2021-4155

Affected products (as reported)

Vendor	Product	Versions
n/a	kernel	Fixed in Kernel v5.16

Weakness: CWE-131

References

https://www.openwall.com/lists/oss-security/2022/01/10/1 x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=2034813 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2021-4155 x_refsource_MISC
https://security-tracker.debian.org/tracker/CVE-2021-4155 x_refsource_MISC
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=983d8e60f50806f90534cc5373d0ce867e5aaf79 x_refsource_MISC