exploitDog

CVE-2021-3570

Опубликовано: 09 июл. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 8

EPSS Низкий

Описание

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1966240
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00025.html
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/
https://www.debian.org/security/2021/dsa-4938
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1966240
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00025.html
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/
https://www.debian.org/security/2021/dsa-4938
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия до 1.5.1 (исключая)

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия от 1.6.0 (включая) до 1.6.1 (исключая)

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия от 1.7.0 (включая) до 1.7.1 (исключая)

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия от 1.8.0 (включая) до 1.8.1 (исключая)

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия от 1.9.0 (включая) до 1.9.3 (исключая)

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.0.1 (исключая)

cpe:2.3:a:linuxptp_project:linuxptp:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.1.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_tus:8.4:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01229

Низкий

8.8 High

CVSS3

8 High

CVSS2

Дефекты

CWE-119

CWE-787

Связанные уязвимости

CVE-2021-3570

CVSS3: 8.8

ubuntu

почти 4 года назад

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

CVE-2021-3570

CVSS3: 8.8

redhat

почти 4 года назад

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

CVE-2021-3570

CVSS3: 8.8

debian

почти 4 года назад

A flaw was found in the ptp4l program of the linuxptp package. A missi ...

openSUSE-SU-2021:3202-1

suse-cvrf

больше 3 лет назад

Security update for linuxptp

openSUSE-SU-2021:1102-1

suse-cvrf

почти 4 года назад

Security update for linuxptp

EPSS

Процентиль: 78%

0.01229

Низкий

8.8 High

CVSS3

8 High

CVSS2

Дефекты

CWE-119

CWE-787