Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-43267: Linux kernel and related firmware allow remote code execution
CVE-2021-43267 · published 4 years ago
Summary
A flaw in the Linux kernel’s TIPC communication code can write beyond its intended memory area, which can be triggered over the network without any user interaction. This affects the core Linux kernel used in many distributions, including Fedora, as well as NetApp H300S and H500S firmware that incorporate the same code. Install the latest kernel and firmware updates from your vendor to protect your systems.
What to do
- Update google :linux_kernel: to version :2022-03-05.
- Update debian linux to version 5.14.16-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Android | :linux_kernel: |
>= :0, < :2022-03-05 Fix: upgrade to :2022-03-05
|
|
| – | linux | linux_kernel |
>= 5.10, < 5.10.77 >= 5.11, < 5.14.16 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
34 35 cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| – | netapp | h300s_firmware |
All versions
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| – | netapp | h500s_firmware |
All versions
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| – | netapp | h700s_firmware |
All versions
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| – | netapp | h300e_firmware |
All versions
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* |
| – | netapp | h500e_firmware |
All versions
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* |
| – | netapp | h700e_firmware |
All versions
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* |
| – | netapp | h410s_firmware |
All versions
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Debian:12 | debian | linux |
< 5.14.16-1 Fix: upgrade to 5.14.16-1
|
Original advisory text
In tipc_crypto_key_rcv of net/tipc/crypto.c , there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with System execution privileges needed...
In tipc_crypto_key_rcv of net/tipc/crypto.c , there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.
References
- https://source.android.com/security/bulletin/2022-03-01 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/02/10/1 Exploit Mailing List Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16 Mailing List Release Notes Vendor Advisory
- https://github.com/torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb... Patch Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.netapp.com/advisory/ntap-20211125-0002/ Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-43267 Vendor Advisory
- https://android.googlesource.com/kernel/common/+/fa40d9734a57bcbfa79a280189799f7... Patch
Severity
9.8
Critical
Type
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published1 Mar 2022
Updated26 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta