{"containers": {"cna": {"affected": [{"product": "Fuchsia Kernel", "vendor": "Google LLC", "versions": [{"lessThan": "4.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don\u2019t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-03T15:50:11", "orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://fuchsia.dev/whats-new/release-notes/f4-1"}, {"tags": ["x_refsource_MISC"], "url": "https://fuchsia-review.googlesource.com/c/fuchsia/+/570881"}], "source": {"discovery": "INTERNAL"}, "title": "Integer Overflow in Fuchsia Kernel", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2021-22556", "STATE": "PUBLIC", "TITLE": "Integer Overflow in Fuchsia Kernel"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Fuchsia Kernel", "version": {"version_data": [{"version_affected": "<", "version_value": "4.1"}]}}]}, "vendor_name": "Google LLC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don\u2019t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-190 Integer Overflow or Wraparound"}]}]}, "references": {"reference_data": [{"name": "https://fuchsia.dev/whats-new/release-notes/f4-1", "refsource": "MISC", "url": "https://fuchsia.dev/whats-new/release-notes/f4-1"}, {"name": "https://fuchsia-review.googlesource.com/c/fuchsia/+/570881", "refsource": "MISC", "url": "https://fuchsia-review.googlesource.com/c/fuchsia/+/570881"}]}, "source": {"discovery": "INTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "assignerShortName": "Google", "cveId": "CVE-2021-22556", "datePublished": "2022-05-03T15:50:11", "dateReserved": "2021-01-05T00:00:00", "dateUpdated": "2022-05-03T15:50:11", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:fuchsia:*:*:*:*:*:*:*:*", "matchCriteriaId": "30CB1FE3-A9A9-43D7-9F7A-D5F2DB4DF462", "versionEndExcluding": "4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don\u2019t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond."}, {"lang": "es", "value": "El equipo de seguridad detect\u00f3 un fallo de desbordamiento de enteros que permite a un atacante con ejecuci\u00f3n de c\u00f3digo emitir operaciones de no comprobaci\u00f3n de la cach\u00e9 de memoria en p\u00e1ginas que no posee, lo que le permite controlar la memoria del kernel desde el espacio de usuario. Es recomendado actualizar a la versi\u00f3n 4.1 del kernel o superior"}], "id": "CVE-2021-22556", "lastModified": "2022-05-10T23:56:13.497", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.2, "source": "cve-coordination@google.com", "type": "Secondary"}]}, "published": "2022-05-03T16:15:18.627", "references": [{"source": "cve-coordination@google.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://fuchsia-review.googlesource.com/c/fuchsia/+/570881"}, {"source": "cve-coordination@google.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://fuchsia.dev/whats-new/release-notes/f4-1"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{}