CVE-2021-3772: Medium severity Linux Linux kernel vulnerability
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.251-1Fixed in 6.1.159-1Fixed in 6.1.164-1Fixed in 6.12.73-1Fixed in 6.12.74-2Fixed in 6.19.6-2Fixed in 6.19.8-1 - Configuration
Append `install sctp /bin/true` to `/etc/modprobe.d/disable-sctp.conf` to prevent the SCTP module from loading.
Linux SCTP kernel module modprobe install command = install sctp /bin/true - Operational
Restart the system if the SCTP modules are currently loaded.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3772?
CVE-2021-3772 is classified as a medium severity vulnerability due to its potential to disrupt existing SCTP associations.
How do I fix CVE-2021-3772?
To remediate CVE-2021-3772, upgrade to the recommended kernel versions provided by your Linux distribution vendor.
Who is affected by CVE-2021-3772?
CVE-2021-3772 affects various Linux kernel versions, specifically those prior to specified patched versions from Red Hat and Debian.
What type of attack does CVE-2021-3772 enable?
CVE-2021-3772 allows a blind attacker to potentially terminate existing SCTP associations through the use of malicious packets.
Which Linux distributions are impacted by CVE-2021-3772?
CVE-2021-3772 impacts Red Hat Enterprise Linux, Debian, and other distributions using vulnerable Linux kernel versions.