Log in Start free

Vulnerability · Published Feb 18, 2022 · Assigned by redhat

CVE-2021-20322

High 7.4

In plain English

A high-severity weak randomness in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.9% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.4High
Exploit odds (30 days)6.9%top 5.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8bpftool4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-abi-stablelists4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-core4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-cross-headers4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-debug4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-debug-core4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-debug-devel4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-debug-modules4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-debug-modules-extra4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-devel4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-doc4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-headers4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-modules4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-modules-extra4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-tools4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-tools-libs4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8kernel-tools-libs-devel4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8perf4.18.0-372.9.1.el8ALSA-2022:1988
AlmaLinux:8python3-perf4.18.0-372.9.1.el8ALSA-2022:1988
Debian:12linux5.14.6-1DEBIAN-CVE-2021-20322
Debian:13linux5.14.6-1DEBIAN-CVE-2021-20322
Debian:14linux5.14.6-1DEBIAN-CVE-2021-20322
Rocky Linux:8kernel0:4.18.0-372.9.1.el8RLSA-2022:1988
Rocky Linux:8kernel-rt0:4.18.0-372.9.1.rt7.166.el8RLSA-2022:1975
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-20322
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-20322
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-20322

Affected products (as reported)

VendorProductVersions
n/a kernel 4.15 – before 4.19.2154.20 – before 5.4.1465.5 – before 5.10.655.11 – before 5.13.175.14 – before 5.14.4

Weakness: CWE-330

References