CVE-2021-44747
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA Denial-of-Service vulnerability exists in the Fmlib component of F-Secure Linux Security products. The vulnerability can be triggered when the anti-virus engine scans specially crafted fuzzed files, causing the Fmlib component to crash and resulting in denial of the Anti-Virus engine service.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2022-02-23_01< 2022-02-23_01<= 2022-02-23_01< 2022-02-23_01< 2022-02-23_01CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed F-Secure productsRun 'rpm -qa | grep -i f-secure' on RPM-based systems or 'dpkg -l | grep -i f-secure' on Debian-based systems. Also check /opt/ for f-secure directories and running processes with 'ps aux | grep fsec'Affected if No F-Secure products are found (not affected)
-
Determine exact product name and versionFor each identified F-Secure product, query its version using the package manager or check the product's version file in /opt/f-secure/<product>/version, or run 'f-secure/<product> --version' if availableAffected if Unable to determine version (assume affected if product is in the list)
-
Check Fmlib component versionLook for the fmlib library in the installation directory, typically under /opt/f-secure/ or check via the main product's about/version information which may list component versionsAffected if fmlib version cannot be determined or is older than 2022-02-23_01
-
Compare against affected version rangesCross-reference the installed product and version against: F-Secure Atlant < 2022-02-23_01, F-Secure Elements Endpoint Protection < 2022-02-23_01, F-Secure Internet Gatekeeper <= 2022-02-23_01, F-Secure Linux Security < 2022-02-23_01, F-Secure Security Cloud < 2022-02-23_01Affected if Installed version is less than (or equal to for Internet Gatekeeper) 2022-02-23_01
The environment is affected if any F-Secure product from the affected list is installed with a version lower than 2022-02-23_01 (or <= 2022-02-23_01 for Internet Gatekeeper), as the vulnerability can be triggered during anti-virus scanning of specially crafted files.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2022-02-23_01
Apply the vendor-provided patch or updated version of F-Secure Linux Security to address the vulnerability in the Fmlib component.
2022-02-23_01 or later for Atlant, Elements Endpoint Protection, Linux Security, and Security Cloud
- Upgrade to F-Secure product version 2022-02-23_01 or later
- Verify the upgrade by checking the product version after installation
- Test that the Anti-Virus engine remains stable when scanning files
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation2.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,072.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-44747 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-44747 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data