CVE-2021-3571: Buffer Overflow
First published: Mon May 31 2021(Updated: )
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/linuxptp | 1.9.2-1+deb10u1 3.1-2.1 3.1.1-4 4.0-1 | |
| Linuxptp Project Linuxptp | <2.0.1 | |
| Linuxptp Project Linuxptp | >=3.0<3.1.1 | |
| Redhat Enterprise Linux | =8.0 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| redhat/linuxptp | <3.1.1 | 3.1.1 |
| redhat/linuxptp | <2.0.1 | 2.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/richardcochran/linuxptp/commit/d61d77e163dbee247819f3d88593ba111577af15
- https://github.com/richardcochran/linuxptp/commit/0b3ab45de6a96ca181a5cf62c3c2b97167e2ed20
- https://www.openwall.com/lists/oss-security/2021/07/06/1
- https://security-tracker.debian.org/tracker/CVE-2021-3571
- https://bugzilla.redhat.com/show_bug.cgi?id=1966241
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/
- https://sourceforge.net/p/linuxptp/code/ci/d61d77e163dbee247819f3d88593ba111577af15
- https://sourceforge.net/p/linuxptp/code/ci/0b3ab45de6a96ca181a5cf62c3c2b97167e2ed20
- https://sourceforge.net/p/linuxptp/code/ci/2eac9118ca82c2d368df5490f4be96ee9e32a80c
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1979401
- https://access.redhat.com/errata/RHSA-2021:4321
- https://access.redhat.com/security/cve/cve-2021-3571
Frequently Asked Questions
What is CVE-2021-3571?
CVE-2021-3571 is a vulnerability found in the ptp4l program of the linuxptp package, which can be exploited by a remote attacker to cause an information leak or crash.
How does CVE-2021-3571 affect me?
If you are using the linuxptp package with the ptp4l program operating on a little-endian architecture as a PTP transparent clock, you may be vulnerable to CVE-2021-3571.
What is the severity of CVE-2021-3571?
The severity of CVE-2021-3571 is high, with a CVSS score of 7.1.
How can I fix CVE-2021-3571?
To fix CVE-2021-3571, update your linuxptp package to version 1.9.2-1+deb10u1, 3.1-2.1, 3.1.1-4, or 4.0-1, depending on the version you are using.
Are there any references for CVE-2021-3571?
Yes, you can find more information about CVE-2021-3571 at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=1966241), [link2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/), [link3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/).
- collector/security-tracker-debian
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3571
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- package-manager/debian
- vendor/linuxptp project
- canonical/linuxptp project linuxptp
- version/linuxptp project linuxptp/3.0
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- package-manager/redhat