CVE-2021-43267
CriticalThe Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
Published Nov 23, 2021 · Updated Oct 14, 2026 · Also known as A-205243414, DEBIAN-CVE-2021-43267, PUB-A-205243414, UBUNTU-CVE-2021-43267
Key Facts
Patch immediately- CVE-2021-43267 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Fedora (Fedoraproject), Linux Kernel, H300e Firmware (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 58% probability of exploitation in the next 30 days.
- Fixed versions are available, including :linux_kernel: :2022-03-05, bpftool 4.18.0-348.2.1.el8_5, bpftool 5.10.46-2.ph4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
58%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-43267 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
Affected Products
113 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FedoraFedoraproject | 34, 35 | n/a |
| Linux KernelLinux | See advisory | 5.10.77 |
| H300e FirmwareNetapp | See advisory | n/a |
| H300s FirmwareNetapp | See advisory | n/a |
| H410s FirmwareNetapp | See advisory | n/a |
Patched Releases
:linux_kernel:
:2022-03-05
bpftool
4.18.0-348.2.1.el8_5, 5.10.46-2.ph4
kernel
0:4.18.0-305.28.1.el8_4, 4.18.0-348.2.1.el8_5, 5.10.78.1-1
kernel-abi-stablelists
4.18.0-348.2.1.el8_5
kernel-core
4.18.0-348.2.1.el8_5
kernel-cross-headers
4.18.0-348.2.1.el8_5
kernel-debug
4.18.0-348.2.1.el8_5
kernel-debug-core
4.18.0-348.2.1.el8_5
kernel-debug-devel
4.18.0-348.2.1.el8_5
kernel-debug-modules
4.18.0-348.2.1.el8_5
kernel-debug-modules-extra
4.18.0-348.2.1.el8_5
kernel-devel
4.18.0-348.2.1.el8_5
kernel-doc
4.18.0-348.2.1.el8_5
kernel-headers
4.18.0-348.2.1.el8_5
kernel-modules
4.18.0-348.2.1.el8_5
kernel-modules-extra
4.18.0-348.2.1.el8_5
kernel-rt
0:4.18.0-305.28.1.rt7.100.el8_4
kernel-tools
4.18.0-348.2.1.el8_5
kernel-tools-libs
4.18.0-348.2.1.el8_5
kernel-tools-libs-devel
4.18.0-348.2.1.el8_5
linux
5.10.46-2.ph4, 5.10.84-1, 5.14.16-1, 5.14.16.arch1-1
Linux Kernel
5.10.77
linux-aws
5.10.78-1.ph4
linux-aws-5.11
5.11.0-1023.24~20.04.1
linux-azure-5.11
5.11.0-1023.24~20.04.1
Timeline
Publicly disclosed
Nov 23, 2021
Last updated
Oct 14, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-1284 Improper Validation of Specified Quantity in Input
References
- advisoryhttp://access.redhat.com/errata/RHSA-2021:4646
- advisoryhttp://access.redhat.com/errata/RHSA-2021:4650
- advisoryRHSA-2021:4644
- advisoryRHSA-2021:4645
- advisoryRHSA-2021:4646
FAQ
Common Questions.
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.
Affected: Fedora (Fedoraproject) versions 34, 35; Linux Kernel; H300e Firmware (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including :linux_kernel: :2022-03-05, bpftool 4.18.0-348.2.1.el8_5, bpftool 5.10.46-2.ph4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-43267 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo