{"id":"CVE-2021-22555","title":"A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c","summary":"A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-787","CWE-787"],"vendor":"netapp","product":"cloud_backup","affected":["c400_firmware","c250_firmware","h410c_firmware","h300s_firmware","h500s_firmware","h700s_firmware","h410s_firmware","linux_kernel >= 2.6.19, < 4.4.267","linux_kernel >= 4.5, < 4.9.267","linux_kernel >= 4.10, < 4.14.231","linux_kernel >= 4.15, < 4.19.188","linux_kernel >= 4.20, < 5.4.113","linux_kernel >= 5.5, < 5.10.31","linux_kernel >= 5.11, < 5.12","fabric_operating_system","fas_8300_firmware","fas_8700_firmware","aff_a400_firmware","aff_a250_firmware","aff_500f_firmware","h610c_firmware","h610s_firmware","h615c_firmware","cloud_backup","hci_management_node","solidfire","solidfire_baseboard_management_controller"],"patched":["linux_kernel 5.12"],"published":"2021-07-07","updated":"2026-10-13","sourceUpdated":"2026-10-13T18:25:34.177","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-22555","references":[{"url":"http://packetstormsecurity.com/files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html","label":"cve-coordination@google.com"},{"url":"http://packetstormsecurity.com/files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.html","label":"cve-coordination@google.com"},{"url":"http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html","label":"cve-coordination@google.com"},{"url":"http://packetstormsecurity.com/files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html","label":"cve-coordination@google.com"},{"url":"http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html","label":"cve-coordination@google.com"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21","label":"cve-coordination@google.com"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d","label":"cve-coordination@google.com"},{"url":"https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528","label":"cve-coordination@google.com"},{"url":"https://security.netapp.com/advisory/ntap-20210805-0010/","label":"cve-coordination@google.com"},{"url":"http://packetstormsecurity.com/files/163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/163878/Kernel-Live-Patch-Security-Notice-LSN-0080-1.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/164437/Netfilter-x_tables-Heap-Out-Of-Bounds-Write-Privilege-Escalation.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210805-0010/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22555","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.78684,"epssPercentile":0.99583,"kev":true,"kevDateAdded":"2025-10-06","kevDueDate":"2025-10-27","kevRansomware":false,"exploited":true,"exploits":{"exploitdb":true,"github":13,"githubRepos":["https://github.com/JoneyJunior/cve-2021-22555","https://github.com/xyjl-ly/CVE-2021-22555-Exploit","https://github.com/cgwalters/container-cve-2021-22555"],"metasploit":["exploit/linux/local/netfilter_xtables_heap_oob_write_priv_esc"],"checkedAt":"2026-10-13T18:42:17.250Z"},"exploitAvailable":true,"ingestedAt":"2026-10-13T18:41:42.717Z","slug":"CVE-2021-22555","body":"## Overview\n\nA heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space\n\n## Affected\n\n- `c400_firmware`\n- `c250_firmware`\n- `h410c_firmware`\n- `h300s_firmware`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h410s_firmware`\n- `linux_kernel >= 2.6.19, < 4.4.267`\n- `linux_kernel >= 4.5, < 4.9.267`\n- `linux_kernel >= 4.10, < 4.14.231`\n- `linux_kernel >= 4.15, < 4.19.188`\n- `linux_kernel >= 4.20, < 5.4.113`\n- `linux_kernel >= 5.5, < 5.10.31`\n- `linux_kernel >= 5.11, < 5.12`\n- `fabric_operating_system`\n- `fas_8300_firmware`\n- `fas_8700_firmware`\n- `aff_a400_firmware`\n- `aff_a250_firmware`\n- `aff_500f_firmware`\n- `h610c_firmware`\n- `h610s_firmware`\n- `h615c_firmware`\n- `cloud_backup`\n- `hci_management_node`\n- `solidfire`\n- `solidfire_baseboard_management_controller`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.12`","depth":"abyssal","depthScore":86,"depthScoreParts":{"impact":45.7,"likelihood":15.7,"exploitation":25,"ransomware":0},"changes":[]}