Security readout for executives and security teams
Plain-English summary
ACRN Device Model through version 2.5 contains a use-after-free memory bug. The sources do not state what an attacker can do with it, whether it is remotely reachable, or whether real-world exploitation has occurred. Treat it as exposure to confirm, not as a proven active incident.
Executive priority
Prioritize discovery first. This CVE affects a specialized virtualization component, but current sources do not establish severity or active exploitation. Escalate if ACRN through 2.5 is found in production or safety-critical systems.
Technical view
CVE-2021-36145 is a use-after-free in ACRN Device Model, specifically devicemodel/core/mem.c, involving a freed rb_entry. The source bundle provides no CVSS score, CWE, attack vector, privilege requirement, impact detail, or downstream vendor mapping.
Likely exposure
Exposure appears limited to environments running ACRN Device Model through 2.5. The bundle does not identify affected CPEs, distributions, appliances, cloud services, or packaged products, so asset inventory must confirm actual ACRN use.
Exploitation context
The bundle marks KEV as false and provides no source claiming active exploitation. A use-after-free can be security-relevant, but exploitability and impact are not established by the cited sources.
Researcher notes
Key gaps are attack surface, trigger conditions, required privileges, impact, and fixed release mapping. The referenced commit is the main technical anchor, but the bundle does not include enough evidence to characterize exploitability.
Mitigation direction
- Inventory systems for ACRN Device Model through version 2.5.
- Check Project ACRN guidance for the commit or a fixed release.
- Update or rebuild only from vendor-confirmed fixed code.
- Limit exposure of systems running vulnerable ACRN components.
- Track downstream vendor advisories for packaged ACRN deployments.
Validation and detection
- Confirm installed ACRN and Device Model versions on relevant hosts.
- Verify whether the referenced upstream commit is present in deployed code.
- Check SBOMs and build manifests for ACRN hypervisor components.
- Review virtualization hosts for unexpected ACRN Device Model deployment.
- Document unknowns where vendor or package evidence is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36145 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/projectacrn/acrn-hypervisor/pull/6058/commits/f880086ffe5423e67d968c8f8f665954786582ceCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.