{"api_version":"1","generated_at":"2026-04-22T23:30:35+00:00","cve":"CVE-2021-4002","urls":{"html":"https://cve.report/CVE-2021-4002","api":"https://cve.report/api/cve/CVE-2021-4002.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-4002","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-4002"},"summary":{"title":"CVE-2021-4002","description":"A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2022-03-03 22:15:00","updated_at":"2023-02-22 17:46:00"},"problem_types":["CWE-401"],"metrics":[],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html","name":"[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2941-1] linux-4.19 security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html","name":"[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2940-1] linux security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea","name":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea","refsource":"MISC","tags":[],"title":"kernel/git/torvalds/linux.git - Linux kernel source tree","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.openwall.com/lists/oss-security/2021/11/25/1","name":"https://www.openwall.com/lists/oss-security/2021/11/25/1","refsource":"MISC","tags":[],"title":"oss-security - CVE-2021-4002: Linux kernel: Missing TLB flush on hugetlbfs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025726","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2025726","refsource":"MISC","tags":[],"title":"2025726 – (CVE-2021-4002) CVE-2021-4002 kernel: possible leak or coruption of data residing on hugetlbfs","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890","name":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890","refsource":"MISC","tags":[],"title":"kernel/git/torvalds/linux.git - Linux kernel source tree","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2022/dsa-5096","name":"DSA-5096","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5096-1 linux","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","name":"N/A","refsource":"N/A","tags":[],"title":"Oracle Critical Patch Update Advisory - July 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4002","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4002","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"5.16","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"5.16","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"5.16","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"communications_cloud_native_core_binding_support_function","cpe6":"22.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"communications_cloud_native_core_network_exposure_function","cpe6":"22.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"4002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"communications_cloud_native_core_policy","cpe6":"22.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-4002","qid":"159760","title":"Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9314)"},{"cve":"CVE-2021-4002","qid":"159763","title":"Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9313)"},{"cve":"CVE-2021-4002","qid":"159777","title":"Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9348)"},{"cve":"CVE-2021-4002","qid":"159825","title":"Oracle Enterprise Linux Security Update for kernel (ELSA-2022-1988)"},{"cve":"CVE-2021-4002","qid":"179117","title":"Debian Security Update for linux (DSA 5096-1)"},{"cve":"CVE-2021-4002","qid":"179118","title":"Debian Security Update for linux (DLA 2940-1)"},{"cve":"CVE-2021-4002","qid":"179119","title":"Debian Security Update for linux-4.19 (DLA 2941-1)"},{"cve":"CVE-2021-4002","qid":"180291","title":"Debian Security Update for linux (CVE-2021-4002)"},{"cve":"CVE-2021-4002","qid":"198616","title":"Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5207-1)"},{"cve":"CVE-2021-4002","qid":"198617","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5209-1)"},{"cve":"CVE-2021-4002","qid":"198618","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5210-1)"},{"cve":"CVE-2021-4002","qid":"198619","title":"Ubuntu Security Notification for Linux kernel (OEM) Vulnerability (USN-5206-1)"},{"cve":"CVE-2021-4002","qid":"198621","title":"Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5208-1)"},{"cve":"CVE-2021-4002","qid":"198627","title":"Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5218-1)"},{"cve":"CVE-2021-4002","qid":"240275","title":"Red Hat Update for kernel-rt (RHSA-2022:1975)"},{"cve":"CVE-2021-4002","qid":"240298","title":"Red Hat Update for kernel security (RHSA-2022:1988)"},{"cve":"CVE-2021-4002","qid":"282133","title":"Fedora Security Update for kernel (FEDORA-2021-19ad835cb3)"},{"cve":"CVE-2021-4002","qid":"353073","title":"Amazon Linux Security Advisory for kernel-livepatch : ALAS2LIVEPATCH-2021-072"},{"cve":"CVE-2021-4002","qid":"353074","title":"Amazon Linux Security Advisory for kernel-livepatch : ALAS2LIVEPATCH-2021-071"},{"cve":"CVE-2021-4002","qid":"353075","title":"Amazon Linux Security Advisory for kernel-livepatch : ALAS2LIVEPATCH-2021-070"},{"cve":"CVE-2021-4002","qid":"353076","title":"Amazon Linux Security Advisory for kernel-livepatch : ALAS2LIVEPATCH-2021-069"},{"cve":"CVE-2021-4002","qid":"353079","title":"Amazon Linux Security Advisory for kernel : ALAS2-2021-1727"},{"cve":"CVE-2021-4002","qid":"353141","title":"Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2022-010"},{"cve":"CVE-2021-4002","qid":"353152","title":"Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2022-008"},{"cve":"CVE-2021-4002","qid":"353161","title":"Amazon Linux Security Advisory for kernel : ALAS-2022-1563"},{"cve":"CVE-2021-4002","qid":"353242","title":"Amazon Linux Security Advisory for kernel : ALAC2012-2022-036"},{"cve":"CVE-2021-4002","qid":"353243","title":"Amazon Linux Security Advisory for kmod-mlx5 : ALAC2012-2022-037"},{"cve":"CVE-2021-4002","qid":"353244","title":"Amazon Linux Security Advisory for kmod-sfc : ALAC2012-2022-038"},{"cve":"CVE-2021-4002","qid":"354747","title":"Amazon Linux Security Advisory for kernel : ALAS-2023-1688"},{"cve":"CVE-2021-4002","qid":"377181","title":"Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2022:0022)"},{"cve":"CVE-2021-4002","qid":"390261","title":"Oracle Managed Virtualization (VM) Server for x86 Security Update for kernel (OVMSA-2022-0014)"},{"cve":"CVE-2021-4002","qid":"671367","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1308)"},{"cve":"CVE-2021-4002","qid":"671380","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1292)"},{"cve":"CVE-2021-4002","qid":"671401","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1328)"},{"cve":"CVE-2021-4002","qid":"671441","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1366)"},{"cve":"CVE-2021-4002","qid":"671498","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1466)"},{"cve":"CVE-2021-4002","qid":"671543","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1475)"},{"cve":"CVE-2021-4002","qid":"671703","title":"EulerOS Security Update for kernel (EulerOS-SA-2022-1735)"},{"cve":"CVE-2021-4002","qid":"751590","title":"OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0056-1)"},{"cve":"CVE-2021-4002","qid":"751600","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0068-1)"},{"cve":"CVE-2021-4002","qid":"751602","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0080-1)"},{"cve":"CVE-2021-4002","qid":"751622","title":"OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0131-1)"},{"cve":"CVE-2021-4002","qid":"751654","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0197-1)"},{"cve":"CVE-2021-4002","qid":"751695","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0367-1)"},{"cve":"CVE-2021-4002","qid":"751697","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0366-1)"},{"cve":"CVE-2021-4002","qid":"751698","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0362-1)"},{"cve":"CVE-2021-4002","qid":"751701","title":"OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0366-1)"},{"cve":"CVE-2021-4002","qid":"751702","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0371-1)"},{"cve":"CVE-2021-4002","qid":"751989","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0131-1)"},{"cve":"CVE-2021-4002","qid":"753133","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0181-1)"},{"cve":"CVE-2021-4002","qid":"753264","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0079-1)"},{"cve":"CVE-2021-4002","qid":"753355","title":"SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0056-1)"},{"cve":"CVE-2021-4002","qid":"900754","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (8988)"},{"cve":"CVE-2021-4002","qid":"901343","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (8988-1)"},{"cve":"CVE-2021-4002","qid":"901477","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (8995-1)"},{"cve":"CVE-2021-4002","qid":"905926","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (8988-2)"},{"cve":"CVE-2021-4002","qid":"906283","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (8995-2)"},{"cve":"CVE-2021-4002","qid":"940517","title":"AlmaLinux Security Update for kernel (ALSA-2022:1988)"},{"cve":"CVE-2021-4002","qid":"960132","title":"Rocky Linux Security Update for kernel-rt (RLSA-2022:1975)"},{"cve":"CVE-2021-4002","qid":"960134","title":"Rocky Linux Security Update for kernel (RLSA-2022:1988)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-4002","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"kernel","version":{"version_data":[{"version_value":"affects kernel v3.6 and later through v5.15.5."}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-459"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2025726","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025726"},{"refsource":"MISC","name":"https://www.openwall.com/lists/oss-security/2021/11/25/1","url":"https://www.openwall.com/lists/oss-security/2021/11/25/1"},{"refsource":"MISC","name":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea","url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea"},{"refsource":"MISC","name":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890","url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html"},{"refsource":"DEBIAN","name":"DSA-5096","url":"https://www.debian.org/security/2022/dsa-5096"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpujul2022.html"}]},"description":{"description_data":[{"lang":"eng","value":"A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data."}]}},"nvd":{"publishedDate":"2022-03-03 22:15:00","lastModifiedDate":"2023-02-22 17:46:00","problem_types":["CWE-401"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.6},"severity":"LOW","exploitabilityScore":3.9,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.16","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"4002","Ordinal":"221799","Title":"CVE-2021-4002","CVE":"CVE-2021-4002","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"4002","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}