medium 6.7

CVE-2022-21499 json

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.

published 2022-06-09 4y ago modified 2026-06-17 4mo ago also EUVD-2022-26723

cvss: 6.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Patch / fix

distros 7 links 1

debian ubuntu red hat suse almalinux rocky linux arch linux

linux Debian 14, Debian 13, Debian 12 5.17.11-1

debian advisories DEBIAN-CVE-2022-21499

linux Ubuntu 20.04 LTS 5.4.0-117.132
linux Ubuntu 22.04 LTS 5.15.0-37.39
linux-aws Ubuntu 20.04 LTS 5.4.0-1078.84
linux-aws Ubuntu 22.04 LTS 5.15.0-1011.14
linux-gcp Ubuntu 20.04 LTS 5.4.0-1078.84
linux-gcp Ubuntu 22.04 LTS 5.15.0-1008.12
linux-gke Ubuntu 20.04 LTS 5.4.0-1074.79
linux-gke Ubuntu 22.04 LTS 5.15.0-1008.10

ubuntu advisories UBUNTU-CVE-2022-21499

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-162.6.1.el9_1
perf RHEL 9 5.14.0-162.6.1.el9_1
bpftool RHEL 9 5.14.0-162.6.1.el9_1
kernel-core RHEL 9 5.14.0-162.6.1.el9_1
kernel-tools RHEL 9 5.14.0-162.6.1.el9_1
python3-perf RHEL 9 5.14.0-162.6.1.el9_1
kernel-modules RHEL 9 5.14.0-162.6.1.el9_1
kernel-zfcpdump RHEL 9 5.14.0-162.6.1.el9_1

red hat advisories RHSA-2022:8267 RHSA-2022:7933 RHSA-2024:0724 RHSA-2022:7683 RHSA-2022:7444

kernel-rt SLE Real Time 12 SP5 4.12.14-10.94.1
kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.94.1
kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.94.1
kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.94.1
kernel-azure SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 5.14.21-150400.14.7.1
kernel-syms-azure SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 5.14.21-150400.14.7.1
kernel-source-azure SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 5.14.21-150400.14.7.1
dtb-aarch64 openSUSE Leap 15.4 5.14.21-150400.24.11.1

suse advisories SUSE-SU-2023:0416-1 SUSE-SU-2022:2629-1 SUSE-SU-2022:2615-1 SUSE-SU-2022:2520-1 SUSE-SU-2022:2482-1 SUSE-SU-2022:2461-1

kernel-rt AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-kvm AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-core AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-modules AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-debug-kvm AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-debug-core AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-debug-modules AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1
kernel-rt-modules-extra AlmaLinux 9 5.14.0-162.6.1.rt21.168.el9_1

almalinux advisories ALSA-2022:7933 ALSA-2022:8267 ALSA-2022:7444 ALSA-2022:7683

kernel Rocky Linux 8 4.18.0-425.3.1.el8
kernel-rt Rocky Linux 8 4.18.0-425.3.1.rt7.213.el8

rocky linux advisories RLSA-2022:7683 RLSA-2022:7444

linux Arch Linux 5.17.10.arch1-1
linux-zen Arch Linux 5.17.10.zen1-1
linux-hardened Arch Linux 5.17.10.hardened1-1
linux-lts Arch Linux 5.15.42-1

arch linux advisories AVG-2740 AVG-2741 AVG-2742 AVG-2743

git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066 advisory

Is CVE-2022-21499 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-21499 updated 2026-11-05 cvss 6.7

kernel: possible to use the debugger to write zero into a location of choice

Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-425.3.1.el8, kernel-debuginfo-common-aarch64 4.18.0-425.3.1.el8, kernel-debuginfo-common-ppc64le 4.18.0-425.3.1.el8
fixed: vendor fix RHSA-2022:7683
Red Hat CodeReady Linux Builder (v. 9) kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-aarch64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-ppc64le 5.14.0-162.6.1.el9_1
fixed: vendor fix RHSA-2022:8267
Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-debuginfo-common-x86_64 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-aarch64 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-ppc64le 4.18.0-372.91.1.el8_6
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-162.6.1.el9_1, kernel-devel-matched 5.14.0-162.6.1.el9_1, kernel-debug-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-zfcpdump-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, +2 more
fixed: vendor fix RHSA-2022:8267
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-425.3.1.el8, kernel 4.18.0-425.3.1.el8, bpftool 4.18.0-425.3.1.el8, kernel-core 4.18.0-425.3.1.el8, kernel-tools 4.18.0-425.3.1.el8, python3-perf 4.18.0-425.3.1.el8, +15 more
fixed: vendor fix RHSA-2022:7683
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-162.6.1.el9_1, bpftool 5.14.0-162.6.1.el9_1, kernel-core 5.14.0-162.6.1.el9_1, kernel-tools 5.14.0-162.6.1.el9_1, python3-perf 5.14.0-162.6.1.el9_1, kernel-modules 5.14.0-162.6.1.el9_1, +14 more
fixed: vendor fix RHSA-2022:8267
Red Hat Enterprise Linux BaseOS EUS (v.8.6) perf 4.18.0-372.91.1.el8_6, kernel 4.18.0-372.91.1.el8_6, bpftool 4.18.0-372.91.1.el8_6, kernel-core 4.18.0-372.91.1.el8_6, kernel-tools 4.18.0-372.91.1.el8_6, python3-perf 4.18.0-372.91.1.el8_6, +15 more
fixed: vendor fix RHSA-2024:0724

show 6 more

Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-425.3.1.rt7.213.el8, kernel-rt-core 4.18.0-425.3.1.rt7.213.el8, kernel-rt-modules 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-core 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-modules 4.18.0-425.3.1.rt7.213.el8, kernel-rt-modules-extra 4.18.0-425.3.1.rt7.213.el8, +2 more
fixed: vendor fix RHSA-2022:7444
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-core 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-modules 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-core 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-modules 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-modules-extra 5.14.0-162.6.1.rt21.168.el9_1, +2 more
fixed: vendor fix RHSA-2022:7933
Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-425.3.1.rt7.213.el8, kernel-rt-kvm 4.18.0-425.3.1.rt7.213.el8, kernel-rt-core 4.18.0-425.3.1.rt7.213.el8, kernel-rt-modules 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-kvm 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-core 4.18.0-425.3.1.rt7.213.el8, +4 more
fixed: vendor fix RHSA-2022:7444
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-kvm 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-core 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-modules 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-kvm 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-core 5.14.0-162.6.1.rt21.168.el9_1, +4 more
fixed: vendor fix RHSA-2022:7933
Red Hat Virtualization 4 Hypervisor for RHEL 8 perf 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-x86_64 4.18.0-372.91.1.el8_6
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2y ago (2024-09-24)

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

Oracle Corporation Oracle Linux
Oracle Corporation Oracle VM

Classification

Weakness

CWE-787 Out-of-bounds Write

References

git.kernel.org /linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066
mailing-list, patch, vendor-advisory
debian.org /security/2022/dsa-5161
vendor-advisory, third-party-advisory
packetstormsecurity.com /files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html
third-party-advisory, vdb-entry

Sources

CVE List CVE-2022-21499
NVD CVE-2022-21499

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed