What’s Vulnerable › Vulnerabilities
CVE-2021-42252
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-10-11 · updated 2026-08-05
Description
An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
Affected products
- Linux kernel: from 4.12 before 4.14.247; from 4.15 before 4.19.207; from 4.20 before 5.4.148; from 5.5 before 5.10.67; from 5.11 before 5.13.19; from 5.14 before 5.14.6 — fixed in 4.14.247, 4.19.207, 5.10.67, 5.13.19, 5.14.6, 5.4.148
- NetApp Cloud Backup: all versions
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Solidfire Baseboard Management Controller Firmware: all versions
How to fix
Upgrade to a fixed version: Linux kernel 4.14.247, 4.19.207, 5.10.67, 5.13.19. Check the vendor advisory for mitigations.
References
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
- https://security.netapp.com/advisory/ntap-20211112-0006/
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
- https://security.netapp.com/advisory/ntap-20211112-0006/
Get alerted when CVE-2021-42252 or the next vulnerability affects your stack