Security readout for executives and security teams
Plain-English summary
CVE-2021-2464 affects Oracle Linux 7 and 8 through the OSwatcher component. A low-privileged user who can log on to the affected infrastructure could compromise the operating system, potentially leading to full host takeover.
Executive priority
Treat as a high-priority server hardening issue, especially for shared, administrative, or high-value Oracle Linux hosts. The key business concern is local access becoming full system compromise.
Technical view
Oracle rates this as CVSS 3.1 7.8 high: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The supplied sources identify Oracle Linux 7 and 8 as affected and point to Oracle errata ELSA-2021-9444 and the April 2022 CPU.
Likely exposure
Exposure is most likely on Oracle Linux 7 or 8 systems where the affected OSwatcher component is present. The attack requires local logon or equivalent access to the infrastructure where Oracle Linux runs.
Exploitation context
The supplied bundle does not show CISA KEV listing or other evidence of active exploitation. Risk is still material because exploitation is described as easy once a low-privileged attacker has logon access.
Researcher notes
Public details are limited. The sources confirm affected versions, OSwatcher as the component, local low-privilege exploitation, and full CIA impact, but do not provide root cause, CWE, or exploit mechanics.
Mitigation direction
- Review Oracle ELSA-2021-9444 and April 2022 CPU guidance for fixed packages.
- Apply relevant Oracle Linux updates through the approved patch process.
- Restrict local logon access to affected Oracle Linux hosts until remediation is confirmed.
- Monitor for suspicious local activity and unexpected privilege changes on affected hosts.
Validation and detection
- Inventory Oracle Linux 7 and 8 systems in the environment.
- Identify systems with the OSwatcher component present.
- Compare installed update levels against Oracle ELSA-2021-9444.
- Confirm the applicable Oracle Linux security update is installed.
- Review recent low-privileged logons on affected hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-2464 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://linux.oracle.com/errata/ELSA-2021-9444.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.