What’s Vulnerable › Vulnerabilities

CVE-2021-43267

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 57.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-02 · updated 2026-06-17
• Weakness: CWE-1284

Description

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.

Affected products

• Fedoraproject Fedora: 34, 35
• Linux kernel: from 5.10 before 5.10.77; from 5.11 before 5.14.16 — fixed in 5.10.77, 5.14.16
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.10.77, 5.14.16. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/02/10/1
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16
• https://github.com/torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVWL7HZV5T5OEKJPO2D67RMFMKBBXGGB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
• https://security.netapp.com/advisory/ntap-20211125-0002/
• http://www.openwall.com/lists/oss-security/2022/02/10/1
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16
• https://github.com/torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVWL7HZV5T5OEKJPO2D67RMFMKBBXGGB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
• https://security.netapp.com/advisory/ntap-20211125-0002/

Get alerted when CVE-2021-43267 or the next vulnerability affects your stack