CVE-2021-3570: Buffer Overflow
A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.
Other sources
When ptp4l is forwarding a PTP message between ports, it uses the messageLength field as the length of transmitted data, but it does not check if the value is not larger than the actual length of the received message. An attacker with access to the network can send a crafted message to cause ptp4l to send data past the message buffer, causing an information leak or crash. If ptp4l runs on a little-endian architecture, the attacker can also craft a management message which causes a heap memory corruption by converting fields from host to network order, potentially leading to remote code execution.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxptpto a version that resolves this vulnerability.Fixed in 1.9.2-1+deb10u1Fixed in 3.1-2.1Fixed in 3.1.1-4Fixed in 4.0-1 - Upgrade
Upgrade
debian/linuxptpto a version that resolves this vulnerability.Fixed in 3.1-2.1Fixed in 1.9.2-1+deb10u1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 2.0.1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 1.9.3 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 1.8.1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 1.7.1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 1.6.1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 2.0.1 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 1.9.3 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 1.8.1 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 1.7.1 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 1.6.1 - Upgrade
Upgrade
linuxptp/ptp4l (ptp4l)to a version that resolves this vulnerability.Fixed in 1.5.1 - Compensating control
Limit network access to ptp4l (send only trusted PTP traffic to the hosts running ptp4l), since an attacker with network access can send crafted PTP messages to trigger the missing length check and potential heap corruption.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3570?
The severity of CVE-2021-3570 is high (8.8).
How does CVE-2021-3570 impact data confidentiality?
CVE-2021-3570 can potentially lead to data confidentiality breaches.
What is the affected software for CVE-2021-3570?
The affected software for CVE-2021-3570 includes Linuxptp Project Linuxptp, Redhat Enterprise Linux, and Fedora.
How can I fix CVE-2021-3570?
To fix CVE-2021-3570, it is recommended to update the linuxptp package to version 1.9.2-1+deb10u1 (for Debian) or 3.1-2.1 (for other distributions).
Where can I find more information about CVE-2021-3570?
You can find more information about CVE-2021-3570 at the following references: [reference 1](https://security-tracker.debian.org/tracker/CVE-2021-3570), [reference 2](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3570), [reference 3](https://security-tracker.debian.org/tracker/CVE-2021-3571).