CVE-2021-22555

The CVSS v3.1 vector for CVE-2021-22555 is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding a score of 8.3 (High). Attack Vector (AV:A) indicates the attacker must be on an adjacent network, meaning local network access is required rather than remote internet-based exploitation. Attack Complexity (AC:H) is high, reflecting that successful exploitation requires specific conditions to be met, such as the ability to create user namespaces and interact with the Netfilter subsystem in a particular way. Privileges Required (PR:N) is none, meaning no authentication is needed to begin the attack, though the attacker does need network adjacency. User Interaction (UI:N) confirms no victim action is needed. Scope (S:C) is changed, indicating the exploit can impact components beyond the vulnerable Netfilter subsystem, specifically enabling full kernel compromise. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high, reflecting complete system compromise potential.

The root cause lies in the xt_compat_target_from_user and xt_compat_match_from_user functions within net/netfilter/x_tables.c. When processing compat structures (used for 32-bit compatibility on 64-bit kernels), the code performs a heap buffer write that exceeds the allocated bounds. Specifically, the padding calculation for compat target and match structures does not properly account for the size difference between compat and native structures, leading to a write beyond the allocated slab object. An attacker can trigger this by creating Netfilter rules through user namespaces, carefully controlling the compat structure contents to corrupt adjacent heap objects. By targeting specific kernel objects in adjacent slab allocations, the attacker can overwrite function pointers to achieve arbitrary code execution in kernel context, resulting in full privilege escalation from an unprivileged user to root.