Buffer overflow in Linuxptp Project
CVE-2021-3571
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
Vulnerability class: Buffer Overflow
EPSS: 0.019 (78.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H.
Affected products
- Linuxptp_project Linuxptp
- Fedoraproject Fedora — versions 33, 34
- Redhat Enterprise_linux — versions 8.0
- N/a Linuxptp — versions linuxptp 3.1.1, linuxptp 2.0.1
Weakness classification (CWE)
References
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (x_refsource_FEDORA, vendor-advisory)
- secalert@redhat.com (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2021-3571?
- CVE-2021-3571 is a high-severity vulnerability in Linuxptp Project, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.1/10. Published 2021-07-09.
- How severe is CVE-2021-3571?
- High severity. CVSS v3 base score is 7.1 out of 10.