CVE-2021-3571: Buffer Overflow
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
Other sources
When ptp4l is operating on a little-endian architecture as a PTP tranparent clock and forwards a one-step sync message, it generates a follow-up message which has an incorrect length, sending data past the message buffer. An attacker with access to the network can send a one-step sync message to cause an information leak or crash.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxptpto a version that resolves this vulnerability.Fixed in 1.9.2-1+deb10u1Fixed in 3.1-2.1Fixed in 3.1.1-4Fixed in 4.0-1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
redhat/linuxptpto a version that resolves this vulnerability.Fixed in 2.0.1 - Upgrade
Upgrade
linuxptp/ptp4lto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
linuxptp/ptp4lto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
What is CVE-2021-3571?
CVE-2021-3571 is a vulnerability found in the ptp4l program of the linuxptp package, which can be exploited by a remote attacker to cause an information leak or crash.
How does CVE-2021-3571 affect me?
If you are using the linuxptp package with the ptp4l program operating on a little-endian architecture as a PTP transparent clock, you may be vulnerable to CVE-2021-3571.
What is the severity of CVE-2021-3571?
The severity of CVE-2021-3571 is high, with a CVSS score of 7.1.
How can I fix CVE-2021-3571?
To fix CVE-2021-3571, update your linuxptp package to version 1.9.2-1+deb10u1, 3.1-2.1, 3.1.1-4, or 4.0-1, depending on the version you are using.
Are there any references for CVE-2021-3571?
Yes, you can find more information about CVE-2021-3571 at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=1966241), [link2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/), [link3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/).