CVE-2021-3570

Published Jul 9, 2021

Last updated a year ago

Overview

Description
A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.
Source
secalert@redhat.com
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
8
Impact score
8.5
Exploitability score
8
Vector string
AV:N/AC:L/Au:S/C:P/I:P/A:C

Weaknesses

nvd@nist.gov
CWE-787
secalert@redhat.com
CWE-119

Social media

Hype score
Not currently trending

Configurations