CVE-2021-3773: Infoleak
First published: Wed Sep 08 2021(Updated: )
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:4.18.0-372.9.1.rt7.166.el8 | 0:4.18.0-372.9.1.rt7.166.el8 |
| redhat/kernel | <0:4.18.0-372.9.1.el8 | 0:4.18.0-372.9.1.el8 |
| Linux Linux kernel | <5.14 | |
| Linux Linux kernel | >=5.15<5.15.15 | |
| Fedoraproject Fedora | =34 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Oracle Communications Cloud Native Core Binding Support Function | =22.1.3 | |
| Oracle Communications Cloud Native Core Network Exposure Function | =22.1.1 | |
| Oracle Communications Cloud Native Core Policy | =22.2.0 |
Remedy
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-3773 https://nvd.nist.gov/vuln/detail/CVE-2021-3773
- https://bugzilla.redhat.com/show_bug.cgi?id=2004949
- https://access.redhat.com/errata/RHSA-2022:1975
- https://access.redhat.com/errata/RHSA-2022:1988
- https://access.redhat.com/security/cve/cve-2021-3773
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.openwall.com/lists/oss-security/2021/09/08/3
- https://breakpointingbad.com/2021/09/08/Port-Shadows-via-Network-Alchemy.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2006005
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2004949#c7
- https://citizenlab.ca/2024/07/vulnerabilities-in-vpns-paper-presented-at-the-privacy-enhancing-technologies-symposium-2024/
Frequently Asked Questions
What is CVE-2021-3773?
CVE-2021-3773 is a vulnerability in netfilter that allows an attacker to infer openvpn connection endpoint information.
How severe is CVE-2021-3773?
CVE-2021-3773 has a severity rating of 9.8, which is classified as critical.
Which software versions are affected by CVE-2021-3773?
The affected software versions include kernel 5.15.15, kernel-rt 4.18.0-372.9.1.rt7.166.el8, kernel 4.18.0-372.9.1.el8, Linux kernel up to version 5.14, Fedora 34, Redhat Enterprise Linux 6.0, 7.0, and 8.0, Oracle Communications Cloud Native Core Binding Support Function 22.1.3, Oracle Communications Cloud Native Core Network Exposure Function 22.1.1, and Oracle Communications Cloud Native Core Policy 22.2.0.
How can an attacker exploit CVE-2021-3773?
An attacker can exploit CVE-2021-3773 to infer openvpn connection endpoint information and use it for further network attacks.
Are there any references for CVE-2021-3773?
Yes, you can find references for CVE-2021-3773 at the following links: [link1](https://www.openwall.com/lists/oss-security/2021/09/08/3), [link2](https://breakpointingbad.com/2021/09/08/Port-Shadows-via-Network-Alchemy.html), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2006005).
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3773
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/5.15
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/6.0
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/8.0
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- canonical/oracle communications cloud native core network exposure function
- version/oracle communications cloud native core network exposure function/22.1.1
- canonical/oracle communications cloud native core policy
- version/oracle communications cloud native core policy/22.2.0