CVE-2021-42252

What it actually does

Incorrect size comparison in aspeed_lpc_ctrl_mmap allows a local process with access to the Aspeed LPC control interface to perform out-of-bounds kernel memory writes.

Why it matters to the business

A local attacker can escalate privileges to root, fully compromise the system, and disrupt operations on affected Linux kernels running on Aspeed hardware.

How an attack unfolds

An attacker with local access opens the Aspeed LPC control device, supplies crafted parameters that bypass the flawed non-size comparison, and writes attacker-controlled data into arbitrary kernel memory locations to achieve code execution.

How to fix it

Upgrade the Linux kernel to version 5.14.6 or later, or apply commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96. Rebuild and reboot with the patched kernel on all Aspeed-based systems.

How to confirm the fix worked

Verify kernel version is 5.14.6 or newer; confirm the presence of commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 in the source tree; test that mmap calls to the LPC device no longer permit oversized mappings.

Typical attack path

1. Obtain local shell or process on target system with access to /dev/aspeed-lpc-ctrl
2. Open the LPC control interface and invoke mmap with malicious size/offset values
3. Trigger the incorrect comparison to perform out-of-bounds kernel write
4. Overwrite kernel function pointers or data structures to gain ring-0 execution
5. Install persistent rootkit or execute arbitrary commands as root

How to detect it

Review kernel logs for unexpected oops or warnings originating from aspeed-lpc-ctrl.c; audit process activity that opens or mmaps the LPC control device; correlate with unusual kernel memory write patterns in forensic memory captures.

What your security team should do

• Immediately identify all systems running kernels before 5.14.6 that expose the Aspeed LPC driver
• Schedule kernel upgrades to 5.14.6+ within the next maintenance window
• Restrict local access to the LPC control device via udev rules or SELinux policies until patched
• Monitor for new public exploits given the low EPSS and lack of KEV listing