Integer Overflow in Fuchsia Kernel
CVE-2021-22556

5.3MEDIUM

Key Information:

Vendor

Google
Status
Fuchsia Kernel
Vendor
CVE Published:
3 May 2022

What is CVE-2021-22556?

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.

Affected Version(s)

Fuchsia Kernel < 4.1

References

https://fuchsia.dev/whats-new/release-notes/f4-1
x_refsource_MISC
https://fuchsia-review.googlesource.com/c/fuchsia/+/570881
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.