Lucene search

K
cvelistGoogleCVELIST:CVE-2021-22566
HistoryJan 18, 2022 - 2:10 p.m.

CVE-2021-22566 Incorrect mapping of Executable bits in Fuchsia Kernel

2022-01-1814:10:10
CWE-275
Google
www.cve.org
5
fuchsia kernel
executable bits
uxn bits
pxn bits
kernel-mode vulnerabilities
mitigation
security update
privileged context
unprivileged context

CVSS4

5.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/SC:L/VI:L/SI:L/VA:N/SA:N

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

43.7%

An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. This can be leveraged by an attacker to bypass executability restrictions of kernel-mode pages from user-mode. An incorrect setting of PXN bits within mmu_flags_to_s1_pte_attr lead to unprivileged executable pages being mapped as executable from a privileged context. This can be leveraged by an attacker to bypass executability restrictions of user-mode pages from kernel-mode. Typically this allows a potential attacker to circumvent a mitigation, making exploitation of potential kernel-mode vulnerabilities easier. We recommend updating kernel beyond commit 7d731b4e9599088ac3073956933559da7bca6a00 and rebuilding.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Fuchsia",
    "repo": "https://fuchsia.googlesource.com/fuchsia",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThan": "7d731b4e9599088ac3073956933559da7bca6a00",
        "status": "affected",
        "version": "0",
        "versionType": "git"
      }
    ]
  }
]

CVSS4

5.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/SC:L/VI:L/SI:L/VA:N/SA:N

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

43.7%

Related for CVELIST:CVE-2021-22566