CVE-2021-44733 is a use-after-free vulnerability in the Linux kernel's TEE subsystem (drivers/tee/tee_shm.c), affecting versions up to 5.15.11, including Debian, Fedora, NetApp, and Red Hat distributions. This high-severity flaw (CVSS 7.0) arises from a race condition during shared memory object deallocation, potentially leading to local privilege escalation with high impact on confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or community discussions are currently identified, its presence in the kernel makes it a notable risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.15.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-44733
Jan 11, 2022kernel: use-after-free in the TEE subsystem
Dec 14, 2021A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.
Dec 14, 2021