PT-2021-3951 · Linuxptp+6 · Linuxptp+6

Guilherme De Almeida Suckevicz · Published 2021-07-05 · Updated 2022-10-07 · CVE-2021-3571

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions linuxptp versions prior to 3.1.1 linuxptp versions prior to 2.0.1

Description A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ptp4l program to minimize the risk of exploitation.

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

ALSA-2021:4321

ALT-PU-2021-2487

BDU:2021-04469

CESA-2021_4321

CVE-2021-3571

OESA-2021-1267

RHSA-2021:4321

RHSA-2021_4321

RLSA-2021:4321

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Red Os

Rocky Linux

Linuxptp

References · 31

• https://osv.dev/vulnerability/OESA-2021-1267 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3571 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3571 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3571 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4321 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1966241 · Patch
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3571 · Security Note
• https://bdu.fstec.ru/vul/2021-04469 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:4321 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3571 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3571 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7 · Vendor Advisory