CVE-2021-3571

Description

A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.

Risk Information

Base Score

7.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

EPSS Score

Exploitation Probability

0.72

Associated Vulnerability

Vulnerability	OS Platform
(RHSA-2021:4321)Moderate: security, bug fix, and enhancement update linuxptp-3.1.1-1.el8.x86_64.rpm	Linux
(RHSA-2021:4321)Moderate: security, bug fix, and enhancement update linuxptp-debuginfo-3.1.1-1.el8.x86_64.rpm	Linux
(RHSA-2021:4321)Moderate: security, bug fix, and enhancement update linuxptp-debugsource-3.1.1-1.el8.x86_64.rpm	Linux
Linuxptp update (ELSA-2021-4321) linuxptp-3.1.1-1.el8.x86_64.rpm	Linux
linuxptp Security Update (ALAS-2021-1705) linuxptp-2.0-2.amzn2.1.2.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234