CVE-2021-22556

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Google LLC	Fuchsia Kernel	>= unspecified, < 4.1

References

https://fuchsia-review.googlesource.com/c/fuchsia/+/570881Issue Tracking, Patch, Third Party Advisory
https://fuchsia.dev/whats-new/release-notes/f4-1Release Notes, Vendor Advisory
https://fuchsia-review.googlesource.com/c/fuchsia/+/570881Issue Tracking, Patch, Third Party Advisory
https://fuchsia.dev/whats-new/release-notes/f4-1Release Notes, Vendor Advisory

Timeline

Published: May 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225577.8SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the S CVE-2021-225610.0Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225634.4Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read CVE-2021-225645.5For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when processing the groups ou CVE-2021-225656.5An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs CVE-2021-225669.8An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unpr CVE-2021-225673.5Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefariou CVE-2021-225688.8When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oau CVE-2021-225695.5An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out o CVE-2021-22574.1Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225705.5Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the p CVE-2021-225715.5A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are