CVE-2021-22543

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Linux Kernel	Linux Kernel	>= add6a0cd1c5ba51b201e1361b05a5df817083618, < f8be156be163a052a067306417cd0ff679068c97

References

http://www.openwall.com/lists/oss-security/2021/06/26/1Mailing List
https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4G5YBUVEPHZYXMKNGBZ3S6INFCTEEL4E/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROQIXQB7ZAWI3KSGSHR6H5RDUWZI775S/
https://security.netapp.com/advisory/ntap-20210708-0002/Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/06/26/1Mailing List
https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4G5YBUVEPHZYXMKNGBZ3S6INFCTEEL4E/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROQIXQB7ZAWI3KSGSHR6H5RDUWZI775S/
https://security.netapp.com/advisory/ntap-20210708-0002/Third Party Advisory

Timeline

Published: May 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225457.8An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the a CVE-2021-225477.8In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger CVE-2021-225487.8An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memo CVE-2021-225497.8An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 CVE-2021-22558.1Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affecte CVE-2021-225507.8An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended t CVE-2021-225525.5An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader CVE-2021-225537.5Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispos CVE-2021-225557.8A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain pri CVE-2021-225567.8The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operatio CVE-2021-225577.8SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the S CVE-2021-225610.0Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte