CVE-2021-22555
📋 TL;DR
This vulnerability allows an attacker to perform heap out-of-bounds writes in the Linux kernel's netfilter subsystem, specifically in x_tables.c. Attackers can exploit this to escalate privileges to root or cause denial of service through heap memory corruption. Systems running Linux kernel versions from 2.6.19-rc1 onward are affected.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Solidfire by Netapp
⚠️ Risk & Real-World Impact
Worst Case
Full root privilege escalation leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain root access on vulnerable systems.
If Mitigated
Limited impact if proper kernel hardening, container isolation, and user namespace restrictions are in place.
🎯 Exploit Status
Exploitation requires local access and user namespace capabilities. Multiple public exploits and proof-of-concepts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commit 6e94e0cfb0887e6f50ddbc0b7821f5a1228d3c9b
Vendor Advisory: https://www.kernel.org/
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution vendor. 2. For Ubuntu: sudo apt update && sudo apt upgrade linux-image-$(uname -r). 3. For RHEL/CentOS: sudo yum update kernel. 4. Reboot system after update.
🔧 Temporary Workarounds
Disable user namespaces
linuxPrevents exploitation by disabling the user namespace feature required for the attack
echo 0 > /proc/sys/user/max_user_namespaces
sysctl -w user.max_user_namespaces=0
Unload netfilter modules
linuxRemove vulnerable x_tables module if not required
modprobe -r x_tables
rmmod x_tables
🧯 If You Can't Patch
- Implement strict user namespace restrictions and monitor for unauthorized namespace creation
- Deploy kernel hardening solutions like SELinux/AppArmor with strict policies to limit impact
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r and compare with affected versions. Check if user namespaces are enabled: cat /proc/sys/user/max_user_namespacesCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is patched: uname -r should be newer than vulnerable versions. Check for patch commit: grep -q '6e94e0cfb0887e6f50ddbc0b7821f5a1228d3c9b' /proc/version📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- OOM killer activity related to netfilter
- Unusual user namespace creation
Network Indicators:
- Abnormal netfilter rule modifications
- Unexpected iptables/nftables changes
SIEM Query:
source="kernel" AND ("panic" OR "Oops" OR "netfilter" OR "x_tables")🔗 References
- http://packetstormsecurity.com/files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html
- http://packetstormsecurity.com/files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.html
- http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html
- http://packetstormsecurity.com/files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html
- http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d
- https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528
- https://security.netapp.com/advisory/ntap-20210805-0010/
- http://packetstormsecurity.com/files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html
- http://packetstormsecurity.com/files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.html
- http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html
- http://packetstormsecurity.com/files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html
- http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d
- https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528
- https://security.netapp.com/advisory/ntap-20210805-0010/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22555
