Nullptr Dereference in Protobuf
Priority LOW 34CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0266 85th percentileScored 2026-11-07
Fix Partial Protobuf (Google LLC): 3.15.0Red Hat: 5 advisoriesRed Hat: 8 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Protobuf | before 3.15.0 | 3.15.0 | Patch available | CNA |
- Protobuf VendorGoogle Affected before 3.15.0 Fixed in 3.15.0 Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:* | before 3.15.0 | Vulnerable | |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | up to 8.0.28 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:* Versions before 3.15.0 Vulnerable ·Google
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions up to 8.0.28 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Protobuf (Google LLC) Fixed in 3.15.0
Red Hat 5 advisories
- RHSA-2024:3433 Released 2024-05-28 · Red Hat rating Moderateprotobuf security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) protobuf-devel-3.5.0-15.el8_6, protobuf-lite-devel-3.5.0-15.el8_6
- Red Hat Enterprise Linux AppStream EUS (v.8.6) protobuf-3.5.0-15.el8_6, protobuf-compiler-3.5.0-15.el8_6, protobuf-lite-3.5.0-15.el8_6 +1
- RHSA-2022:8860 Released 2022-12-07 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1.9 (protobuf) security update
- Red Hat OpenStack Platform 16.1 protobuf-3.6.1-6.el8ost, python3-protobuf-3.6.1-6.el8ost
- RHSA-2022:8847 Released 2022-12-07 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2.4 (protobuf) security update
- Red Hat OpenStack Platform 16.2 protobuf-3.6.1-6.el8ost, python3-protobuf-3.6.1-6.el8ost
Show 2 more Red Hat advisories
- RHSA-2022:7970 Released 2022-11-15 · Red Hat rating Moderateprotobuf security update
- Red Hat CodeReady Linux Builder (v. 9) protobuf-compiler-3.14.0-13.el9, protobuf-devel-3.14.0-13.el9, protobuf-lite-devel-3.14.0-13.el9
- Red Hat Enterprise Linux AppStream (v. 9) protobuf-3.14.0-13.el9, protobuf-lite-3.14.0-13.el9, python3-protobuf-3.14.0-13.el9
- RHSA-2022:7464 Released 2022-11-08 · Red Hat rating Moderateprotobuf security update
- Red Hat CodeReady Linux Builder (v. 8) protobuf-devel-3.5.0-15.el8, protobuf-lite-devel-3.5.0-15.el8
- Red Hat Enterprise Linux AppStream (v. 8) protobuf-3.5.0-15.el8, protobuf-compiler-3.5.0-15.el8, protobuf-lite-3.5.0-15.el8 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2022:7464 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2022:7970 |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2024:3433 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7464 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7970 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:3433 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2022:8860 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:8847 |
Not affected: 1 product
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22570
References
Advisory 10
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0
- FEDORA-2022-ffe4a1cedd
- FEDORA-2022-2d3e6eb9e4
- FEDORA-2022-fedff53e4e
- FEDORA-2022-486d5f349d
- FEDORA-2022-d1a15f9cdb
- FEDORA-2022-49b52819a4
- FEDORA-2022-57923346cf
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220429-0005/
More Google Protobuf vulnerabilities
- TI-2024-06719 Stack overflow in Protocol Buffers Java Lite CVSS 4.0HIGH 8.7
- TI-2015-04398 protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. CVSS 3.1HIGH 8.8
- TI-2026-00748 Denial of Service in Python Protobuf CVSS 4.0HIGH 8.2
- TI-2024-02238 Use after free in C++ protobuf CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-22570 · CVE Program
- CVE-2021-22570 · NVD
- FIRST EPSS
- CVE-2021-22570 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences