CVE-2021-3772
First published: Thu Sep 02 2021(Updated: )
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-372.9.1.rt7.166.el8 | 0:4.18.0-372.9.1.rt7.166.el8 |
| redhat/kernel | <0:4.18.0-372.9.1.el8 | 0:4.18.0-372.9.1.el8 |
| ubuntu/linux | <4.15.0-184.194 | 4.15.0-184.194 |
| ubuntu/linux | <5.4.0-117.132 | 5.4.0-117.132 |
| ubuntu/linux | <5.13.0-28.31 | 5.13.0-28.31 |
| ubuntu/linux | <5.15 | 5.15 |
| ubuntu/linux | <4.4.0-239.273 | 4.4.0-239.273 |
| ubuntu/linux-aws | <4.15.0-1133.143 | 4.15.0-1133.143 |
| ubuntu/linux-aws | <5.4.0-1078.84 | 5.4.0-1078.84 |
| ubuntu/linux-aws | <5.13.0-1012.13 | 5.13.0-1012.13 |
| ubuntu/linux-aws | <4.4.0-1117.123 | 4.4.0-1117.123 |
| ubuntu/linux-aws | <5.15 | 5.15 |
| ubuntu/linux-aws | <4.4.0-1155.170 | 4.4.0-1155.170 |
| ubuntu/linux-aws-5.0 | <5.15 | 5.15 |
| ubuntu/linux-aws-5.11 | <5.11.0-1028.31~20.04.1 | 5.11.0-1028.31~20.04.1 |
| ubuntu/linux-aws-5.11 | <5.15 | 5.15 |
| ubuntu/linux-aws-5.13 | <5.13.0-1012.13~20.04.1 | 5.13.0-1012.13~20.04.1 |
| ubuntu/linux-aws-5.13 | <5.15 | 5.15 |
| ubuntu/linux-aws-5.15 | <5.15 | 5.15 |
| ubuntu/linux-aws-5.3 | <5.15 | 5.15 |
| ubuntu/linux-aws-5.4 | <5.4.0-1078.84~18.04.1 | 5.4.0-1078.84~18.04.1 |
| ubuntu/linux-aws-5.4 | <5.15 | 5.15 |
| ubuntu/linux-aws-5.8 | <5.15 | 5.15 |
| ubuntu/linux-aws-hwe | <5.15 | 5.15 |
| ubuntu/linux-aws-hwe | <4.15.0-1133.143~16.04.1 | 4.15.0-1133.143~16.04.1 |
| ubuntu/linux-azure | <5.4.0-1083.87 | 5.4.0-1083.87 |
| ubuntu/linux-azure | <5.13.0-1013.15 | 5.13.0-1013.15 |
| ubuntu/linux-azure | <4.15.0-1142.156~14.04.1 | 4.15.0-1142.156~14.04.1 |
| ubuntu/linux-azure | <5.15 | 5.15 |
| ubuntu/linux-azure | <4.15.0-1142.156~16.04.1 | 4.15.0-1142.156~16.04.1 |
| ubuntu/linux-azure-4.15 | <4.15.0-1142.156 | 4.15.0-1142.156 |
| ubuntu/linux-azure-4.15 | <5.15 | 5.15 |
| ubuntu/linux-azure-5.11 | <5.11.0-1028.31~20.04.2 | 5.11.0-1028.31~20.04.2 |
| ubuntu/linux-azure-5.11 | <5.15 | 5.15 |
| ubuntu/linux-azure-5.13 | <5.13.0-1013.15~20.04.1 | 5.13.0-1013.15~20.04.1 |
| ubuntu/linux-azure-5.13 | <5.15 | 5.15 |
| ubuntu/linux-azure-5.15 | <5.15 | 5.15 |
| ubuntu/linux-azure-5.3 | <5.15 | 5.15 |
| ubuntu/linux-azure-5.4 | <5.4.0-1083.87~18.04.1 | 5.4.0-1083.87~18.04.1 |
| ubuntu/linux-azure-5.4 | <5.15 | 5.15 |
| ubuntu/linux-azure-edge | <5.15 | 5.15 |
| ubuntu/linux-azure-fde | <5.4.0-1083.87 | 5.4.0-1083.87 |
| ubuntu/linux-azure-fde | <5.15 | 5.15 |
| ubuntu/linux-azure-fde-5.15 | <5.15 | 5.15 |
| ubuntu/linux-bluefield | <5.4.0-1040.44 | 5.4.0-1040.44 |
| ubuntu/linux-bluefield | <5.15 | 5.15 |
| ubuntu/linux-dell300x | <4.15.0-1047.52 | 4.15.0-1047.52 |
| ubuntu/linux-dell300x | <5.15 | 5.15 |
| ubuntu/linux-fips | <5.15 | 5.15 |
| ubuntu/linux-gcp | <5.4.0-1078.84 | 5.4.0-1078.84 |
| ubuntu/linux-gcp | <5.13.0-1013.16 | 5.13.0-1013.16 |
| ubuntu/linux-gcp | <5.15 | 5.15 |
| ubuntu/linux-gcp | <4.15.0-1127.142~16.04.1 | 4.15.0-1127.142~16.04.1 |
| ubuntu/linux-gcp-4.15 | <4.15.0-1127.142 | 4.15.0-1127.142 |
| ubuntu/linux-gcp-4.15 | <5.15 | 5.15 |
| ubuntu/linux-gcp-5.11 | <5.11.0-1029.33~20.04.3 | 5.11.0-1029.33~20.04.3 |
| ubuntu/linux-gcp-5.11 | <5.15 | 5.15 |
| ubuntu/linux-gcp-5.13 | <5.13.0-1013.16~20.04.1 | 5.13.0-1013.16~20.04.1 |
| ubuntu/linux-gcp-5.13 | <5.15 | 5.15 |
| ubuntu/linux-gcp-5.15 | <5.15 | 5.15 |
| ubuntu/linux-gcp-5.3 | <5.15 | 5.15 |
| ubuntu/linux-gcp-5.4 | <5.4.0-1078.84~18.04.1 | 5.4.0-1078.84~18.04.1 |
| ubuntu/linux-gcp-5.8 | <5.15 | 5.15 |
| ubuntu/linux-gcp-edge | <5.15 | 5.15 |
| ubuntu/linux-gke | <5.4.0-1074.79 | 5.4.0-1074.79 |
| ubuntu/linux-gke | <5.15 | 5.15 |
| ubuntu/linux-gke-4.15 | <5.15 | 5.15 |
| ubuntu/linux-gke-5.0 | <5.15 | 5.15 |
| ubuntu/linux-gke-5.15 | <5.15 | 5.15 |
| ubuntu/linux-gke-5.3 | <5.15 | 5.15 |
| ubuntu/linux-gke-5.4 | <5.4.0-1074.79~18.04.1 | 5.4.0-1074.79~18.04.1 |
| ubuntu/linux-gke-5.4 | <5.15 | 5.15 |
| ubuntu/linux-gkeop | <5.4.0-1046.48 | 5.4.0-1046.48 |
| ubuntu/linux-gkeop | <5.15 | 5.15 |
| ubuntu/linux-gkeop-5.4 | <5.4.0-1046.48~18.04.1 | 5.4.0-1046.48~18.04.1 |
| ubuntu/linux-gkeop-5.4 | <5.15 | 5.15 |
| ubuntu/linux-hwe | <5.15 | 5.15 |
| ubuntu/linux-hwe | <4.15.0-184.194~16.04.1 | 4.15.0-184.194~16.04.1 |
| ubuntu/linux-hwe-5.11 | <5.15 | 5.15 |
| ubuntu/linux-hwe-5.13 | <5.13.0-28.31~20.04.1 | 5.13.0-28.31~20.04.1 |
| ubuntu/linux-hwe-5.13 | <5.15 | 5.15 |
| ubuntu/linux-hwe-5.15 | <5.15 | 5.15 |
| ubuntu/linux-hwe-5.4 | <5.4.0-117.132~18.04.1 | 5.4.0-117.132~18.04.1 |
| ubuntu/linux-hwe-5.4 | <5.15 | 5.15 |
| ubuntu/linux-hwe-5.8 | <5.15 | 5.15 |
| ubuntu/linux-hwe-edge | <5.15 | 5.15 |
| ubuntu/linux-ibm | <5.4.0-1026.29 | 5.4.0-1026.29 |
| ubuntu/linux-ibm | <5.15 | 5.15 |
| ubuntu/linux-ibm-5.4 | <5.4.0-1028.32~18.04.1 | 5.4.0-1028.32~18.04.1 |
| ubuntu/linux-ibm-5.4 | <5.15 | 5.15 |
| ubuntu/linux-intel-5.13 | <5.15 | 5.15 |
| ubuntu/linux-intel-iotg | <5.15 | 5.15 |
| ubuntu/linux-intel-iotg-5.15 | <5.15 | 5.15 |
| ubuntu/linux-kvm | <4.15.0-1119.123 | 4.15.0-1119.123 |
| ubuntu/linux-kvm | <5.4.0-1068.72 | 5.4.0-1068.72 |
| ubuntu/linux-kvm | <5.13.0-1011.12 | 5.13.0-1011.12 |
| ubuntu/linux-kvm | <5.15 | 5.15 |
| ubuntu/linux-kvm | <4.4.0-1118.128 | 4.4.0-1118.128 |
| ubuntu/linux-lowlatency | <5.15 | 5.15 |
| ubuntu/linux-lowlatency-hwe-5.15 | <5.15 | 5.15 |
| ubuntu/linux-lowlatency-hwe-5.19 | <5.15 | 5.15 |
| ubuntu/linux-lts-xenial | <4.4.0-239.273~14.04.1 | 4.4.0-239.273~14.04.1 |
| ubuntu/linux-lts-xenial | <5.15 | 5.15 |
| ubuntu/linux-oem | <5.15 | 5.15 |
| ubuntu/linux-oem-5.10 | <5.15 | 5.15 |
| ubuntu/linux-oem-5.13 | <5.13.0-1029.36 | 5.13.0-1029.36 |
| ubuntu/linux-oem-5.13 | <5.15 | 5.15 |
| ubuntu/linux-oem-5.14 | <5.14.0-1008.8 | 5.14.0-1008.8 |
| ubuntu/linux-oem-5.17 | <5.15 | 5.15 |
| ubuntu/linux-oem-5.6 | <5.15 | 5.15 |
| ubuntu/linux-oem-6.0 | <5.15 | 5.15 |
| ubuntu/linux-oem-6.1 | <5.15 | 5.15 |
| ubuntu/linux-oem-osp1 | <5.15 | 5.15 |
| ubuntu/linux-oracle | <4.15.0-1098.108 | 4.15.0-1098.108 |
| ubuntu/linux-oracle | <5.4.0-1076.83 | 5.4.0-1076.83 |
| ubuntu/linux-oracle | <5.13.0-1016.20 | 5.13.0-1016.20 |
| ubuntu/linux-oracle | <5.15 | 5.15 |
| ubuntu/linux-oracle | <4.15.0-1098.108~16.04.1 | 4.15.0-1098.108~16.04.1 |
| ubuntu/linux-oracle-5.0 | <5.15 | 5.15 |
| ubuntu/linux-oracle-5.11 | <5.11.0-1028.31~20.04.1 | 5.11.0-1028.31~20.04.1 |
| ubuntu/linux-oracle-5.11 | <5.15 | 5.15 |
| ubuntu/linux-oracle-5.13 | <5.13.0-1016.20~20.04.1 | 5.13.0-1016.20~20.04.1 |
| ubuntu/linux-oracle-5.13 | <5.15 | 5.15 |
| ubuntu/linux-oracle-5.15 | <5.15 | 5.15 |
| ubuntu/linux-oracle-5.3 | <5.15 | 5.15 |
| ubuntu/linux-oracle-5.4 | <5.4.0-1076.83~18.04.1 | 5.4.0-1076.83~18.04.1 |
| ubuntu/linux-raspi | <5.4.0-1065.75 | 5.4.0-1065.75 |
| ubuntu/linux-raspi | <5.13.0-1016.18 | 5.13.0-1016.18 |
| ubuntu/linux-raspi | <5.15 | 5.15 |
| ubuntu/linux-raspi-5.4 | <5.4.0-1065.75~18.04.1 | 5.4.0-1065.75~18.04.1 |
| ubuntu/linux-raspi-5.4 | <5.15 | 5.15 |
| ubuntu/linux-raspi2 | <4.15.0-1114.122 | 4.15.0-1114.122 |
| ubuntu/linux-raspi2 | <5.15 | 5.15 |
| ubuntu/linux-raspi2-5.3 | <5.15 | 5.15 |
| ubuntu/linux-riscv | <5.13.0-1011.12 | 5.13.0-1011.12 |
| ubuntu/linux-riscv | <5.15 | 5.15 |
| ubuntu/linux-riscv-5.11 | <5.15 | 5.15 |
| ubuntu/linux-riscv-5.8 | <5.15 | 5.15 |
| ubuntu/linux-snapdragon | <4.15.0-1132.142 | 4.15.0-1132.142 |
| ubuntu/linux-snapdragon | <5.15 | 5.15 |
| debian/linux | 4.19.249-2 4.19.304-1 5.10.209-2 5.10.205-2 6.1.76-1 6.1.85-1 6.6.15-2 6.7.12-1 | |
| Linux Linux kernel | <5.15.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Oracle Communications Cloud Native Core Binding Support Function | =22.1.3 | |
| Oracle Communications Cloud Native Core Network Exposure Function | =22.1.1 | |
| Oracle Communications Cloud Native Core Policy | =22.2.0 | |
| NetApp E-Series SANtricity OS Controller | =11.0 | |
| NetApp E-Series SANtricity OS Controller | =11.0.0 | |
| NetApp E-Series SANtricity OS Controller | =11.20 | |
| NetApp E-Series SANtricity OS Controller | =11.25 | |
| NetApp E-Series SANtricity OS Controller | =11.30 | |
| NetApp E-Series SANtricity OS Controller | =11.30.5r3 | |
| NetApp E-Series SANtricity OS Controller | =11.40 | |
| NetApp E-Series SANtricity OS Controller | =11.40.3r2 | |
| NetApp E-Series SANtricity OS Controller | =11.40.5 | |
| NetApp E-Series SANtricity OS Controller | =11.50.1 | |
| NetApp E-Series SANtricity OS Controller | =11.50.2 | |
| NetApp E-Series SANtricity OS Controller | =11.50.2-p1 | |
| NetApp E-Series SANtricity OS Controller | =11.60 | |
| NetApp E-Series SANtricity OS Controller | =11.60.0 | |
| NetApp E-Series SANtricity OS Controller | =11.60.1 | |
| NetApp E-Series SANtricity OS Controller | =11.60.3 | |
| NetApp E-Series SANtricity OS Controller | =11.70.1 | |
| NetApp E-Series SANtricity OS Controller | =11.70.2 | |
| Netapp Solidfire \& Hci Management Node | ||
| Netapp Solidfire \& Hci Storage Node | ||
| Netapp Hci Compute Node | ||
| All of | ||
| Netapp H300s Firmware | ||
| Netapp H300s | ||
| All of | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| All of | ||
| Netapp H700s Firmware | ||
| Netapp H700s | ||
| All of | ||
| Netapp H410s Firmware | ||
| Netapp H410s | ||
| All of | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| All of | ||
| Netapp H610c Firmware | ||
| Netapp H610c | ||
| All of | ||
| Netapp H610s Firmware | ||
| Netapp H610s | ||
| All of | ||
| Netapp H615c Firmware | ||
| Netapp H615c | ||
| Netapp H300s Firmware | ||
| Netapp H300s | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| Netapp H700s Firmware | ||
| Netapp H700s | ||
| Netapp H410s Firmware | ||
| Netapp H410s | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| Netapp H610c Firmware | ||
| Netapp H610c | ||
| Netapp H610s Firmware | ||
| Netapp H610s | ||
| Netapp H615c Firmware | ||
| Netapp H615c |
Remedy
As the SCTP module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: if # echo "install sctp /bin/true" >> /etc/modprobe.d/disable-sctp.conf The system will need to be restarted if the SCTP modules are loaded. In most circumstances, the SCTP kernel modules will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-3772 https://nvd.nist.gov/vuln/detail/CVE-2021-3772
- https://bugzilla.redhat.com/show_bug.cgi?id=2000694
- https://access.redhat.com/errata/RHSA-2022:1975
- https://access.redhat.com/errata/RHSA-2022:1988
- https://access.redhat.com/security/cve/CVE-2021-3772
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
- https://github.com/torvalds/linux/commit/32f8807a48ae55be0e76880cfe8607a18b5bb0df
- https://ubuntu.com/security/CVE-2021-3772
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.debian.org/security/2022/dsa-5096
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
- https://security.netapp.com/advisory/ntap-20221007-0001/
- https://launchpad.net/bugs/cve/CVE-2021-3772
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2002157
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2000694#c0
- https://git.kernel.org/linus/a2d859e3fc97e79d907761550dbc03ff1b36479c
- https://git.kernel.org/linus/32f8807a48ae55be0e76880cfe8607a18b5bb0df
- https://access.redhat.com/security/cve/cve-2021-3772
- https://security-tracker.debian.org/tracker/CVE-2021-3772
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
- https://ubuntu.com/security/notices/USN-5165-1
- https://ubuntu.com/security/notices/USN-5265-1
- https://ubuntu.com/security/notices/USN-5466-1
- https://ubuntu.com/security/notices/USN-5467-1
- https://ubuntu.com/security/notices/USN-6001-1
- https://ubuntu.com/security/notices/USN-6013-1
- https://ubuntu.com/security/notices/USN-6014-1
- https://www.cve.org/CVERecord?id=CVE-2021-3772
- https://nvd.nist.gov/vuln/detail/CVE-2021-3772
- https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
- https://git.kernel.org/linus/4f7019c7eb33967eb87766e0e4602b5576873680
- https://git.kernel.org/linus/eae5783908042a762c24e1bd11876edb91d314b1
- https://git.kernel.org/linus/438b95a7c98f77d51cbf4db021f41b602d750a3f
- https://git.kernel.org/linus/a64b341b8695e1c744dd972b39868371b4f68f83
- https://git.kernel.org/linus/aa0f697e45286a6b5f0ceca9418acf54b9099d99
- https://git.kernel.org/linus/ef16b1734f0a176277b7bb9c71a6d977a6ef3998
- https://git.kernel.org/linus/9d02831e517aa36ee6bdb453a0eb47bd49923fe3
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3772
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/event
- agent/description
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/ubuntu
- package-manager/debian
- vendor/linux
- canonical/linux linux kernel
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- canonical/oracle communications cloud native core network exposure function
- version/oracle communications cloud native core network exposure function/22.1.1
- canonical/oracle communications cloud native core policy
- version/oracle communications cloud native core policy/22.2.0
- vendor/netapp
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.20
- version/netapp e-series santricity os controller/11.25
- version/netapp e-series santricity os controller/11.30
- version/netapp e-series santricity os controller/11.30.5r3
- version/netapp e-series santricity os controller/11.40
- version/netapp e-series santricity os controller/11.40.3r2
- version/netapp e-series santricity os controller/11.40.5
- version/netapp e-series santricity os controller/11.50.1
- version/netapp e-series santricity os controller/11.50.2
- version/netapp e-series santricity os controller/11.50.2-p1
- version/netapp e-series santricity os controller/11.60
- version/netapp e-series santricity os controller/11.60.0
- version/netapp e-series santricity os controller/11.60.1
- version/netapp e-series santricity os controller/11.60.3
- version/netapp e-series santricity os controller/11.70.1
- version/netapp e-series santricity os controller/11.70.2
- canonical/netapp solidfire \& hci management node
- canonical/netapp solidfire \& hci storage node
- canonical/netapp hci compute node
- canonical/netapp h300s firmware
- canonical/netapp h300s
- canonical/netapp h500s firmware
- canonical/netapp h500s
- canonical/netapp h700s firmware
- canonical/netapp h700s
- canonical/netapp h410s firmware
- canonical/netapp h410s
- canonical/netapp h410c firmware
- canonical/netapp h410c
- canonical/netapp h610c firmware
- canonical/netapp h610c
- canonical/netapp h610s firmware
- canonical/netapp h610s
- canonical/netapp h615c firmware
- canonical/netapp h615c