CVE-2021-22570: debian debian_linux NULL Pointer Dereference
CVSS: 6.5v3.1MediumModified
AliasesSUSE-SU-2022:1040-1SUSE-SU-2022:1040-2SUSE-SU-2022:1040-3GHSA-77rm-9x9h-xj3gPYSEC-2022-48RHSA-2022:7464RHSA-2022:7970RHSA-2022:8847RHSA-2022:8860RHSA-2024:3433UBUNTU-CVE-2021-22570USN-5490-1DEBIAN-CVE-2021-22570CGA-472w-p6fg-r534CGA-jqgx-x7mp-vw84openSUSE-SU-2022:0823-1openSUSE-SU-2022:1040-1CGA-25jr-4w8c-rc5jCGA-25v3-crq7-v97mCGA-4q58-6rc5-2fr2CGA-552j-64rv-jwrgCGA-6g23-4jq4-v54gCGA-6hfc-gcfg-4w9xCGA-7hwj-7m33-5qhcCGA-cxr3-5vw5-w2qxCGA-f5p7-cmx2-pxq4CGA-f8c8-4953-7q44CGA-g5qm-ff9p-vv23CGA-m75r-rgm5-895gCGA-mj43-3qr9-p8jhCGA-q56q-w6p4-2g7qCGA-q6qh-v3ch-7wv6CGA-rfwf-26q4-vgchCGA-rjmv-4j86-p24hCGA-vfr3-692x-488w
Published 26-01-2022Last modified 21-04-2025
Vulnerability summary
CVE-2021-22570 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 2.66% chance of exploitation in the next 30 days, higher than 85.4% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
2.66%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 7Timeline
- 26-01-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
CVSS metrics
16 scores · 11 sources · 3 versionsHigh 8.7Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · GoEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · MavenEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · NugetEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Medium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSources11 sources · 5.5–7.5
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.66%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.66% on 18-09-2026
18-09-202618-10-2026
EPSS score2.66%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse23 products
- protobuf&distro=SUSE Enterprise Storage 7< 3.9.2-4.12.1
- protobuf&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 3.9.2-4.12.1
- protobuf&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 3.9.2-4.12.1
- protobuf&distro=SUSE Linux Enterprise Installer Updates 15 SP2< 3.9.2-4.12.1
- protobuf&distro=SUSE Linux Enterprise Micro 5.0< 3.9.2-4.12.1
Chainguard10 products
- druid< 34.0.0-r6
- hadoop-client-modules< 3.3.6-r7
- mysql-8.0< 8.0.38-r0
- mysql-8.0-client< 8.0.38-r0
- mysql-8.0-dev< 8.0.38-r0
Redhat10 products
- protobuf< 0:3.5.0-15.el8 | < 0:3.14.0-13.el9 | < 0:3.6.1-6.el8ost | < 0:3.5.0-15.el8_6
- protobuf-compiler< 0:3.5.0-15.el8 | < 0:3.14.0-13.el9 | < 0:3.5.0-15.el8_6
- protobuf-compiler-debuginfo< 0:3.5.0-15.el8 | < 0:3.14.0-13.el9 | < 0:3.5.0-15.el8_6
- protobuf-debuginfo< 0:3.5.0-15.el8 | < 0:3.14.0-13.el9 | < 0:3.5.0-15.el8_6
- protobuf-debugsource< 0:3.5.0-15.el8 | < 0:3.14.0-13.el9 | < 0:3.5.0-15.el8_6
Netapp4 products
Debian2 products
- protobuf< 3.21.9-3
- debian_linuxEOL9.0 | 10.0 | 11.0
Google2 products
- protobuf< 3.15.0
- protobuf< 3.15.0
Com.google.protobuf1 product
- protobuf-java< 3.15.0
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Github.com/protocolbuffers1 product
- protobuf< 0.0.0-20210218195015-ae50d9b99025 | ≥ 0.0.0, < 3.15.0
Google llc1 product
- protobuf≥ unspecified, < 3.15.0
NuGet1 product
- Google.Protobuf< 3.15.0
Opensuse1 product
- protobuf&distro=openSUSE Leap 15.3< 3.5.0-5.5.1 | < 3.9.2-4.12.1
Oracle1 product
- mysql≤ 8.0.28
PyPI1 product
- protobuf< 3.15.0
Ubuntu1 product
- protobuf< 2.5.0-9ubuntu1+esm1 | < 3.0.0-9.1ubuntu1.1 | < 3.6.1.3-2ubuntu5.2 | < 3.12.4-1ubuntu7.22.04.1 | < 2.6.1-1.3ubuntu0.1~esm1
Wolfi1 product
- druid< 34.0.0-r6
16 vendors · 61 products
References
52 links- github.com/protocolbuffers/protobuf/releases/tag/v3.15.0WEBREPORTAdvisoryRelease NotesThird Party Advisory
Show all 52 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory