Vulnerability Description
A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxptp Project | Linuxptp | < 1.5.1 |
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux Aus | 8.2 |
| Redhat | Enterprise Linux Eus | 8.1 |
| Redhat | Enterprise Linux Tus | 8.2 |
| Fedoraproject | Fedora | 33 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1966240Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/07/msg00025.htmlThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.debian.org/security/2021/dsa-4938Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1966240Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/07/msg00025.htmlThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.debian.org/security/2021/dsa-4938Third Party Advisory
FAQ
What is CVE-2021-3570?
CVE-2021-3570 is a vulnerability with a CVSS score of 8.8 (HIGH). A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or poten...
How severe is CVE-2021-3570?
CVE-2021-3570 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3570?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxptp Project Linuxptp, Redhat Enterprise Linux, Redhat Enterprise Linux Aus, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Tus.