CVE-2021-43267

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

57.85% chance of exploitation in the next 30 days, 99th percentile

Published

2021-11-02

Updated

2024-08-04

Proof-of-concept exploits (2)

• DarkSprings/CVE-2021-43267-POC0★ · 2021-11-09
• zzhacked/CVE-2021-432674★ · 2021-11-26

Security advisories

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16
• http://www.openwall.com/lists/oss-security/2022/02/10/1
• torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0
• https://security.netapp.com/advisory/ntap-20211125-0002

References

• CVE Record
• NVD entry

Related

• CVE-2021-38639
• CVE-2021-38666
• CVE-2021-40444
• CVE-2021-40539
• CVE-2021-42321