#VU54574 Memory leak in linuxptp - CVE-2021-3571

Vulnerability identifier: #VU54574

Vulnerability risk: Medium

CVSSv4.0: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3571

CWE-ID: CWE-401

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
linuxptp
Universal components / Libraries / Libraries used by multiple products

Vendor: Richard Cochran

Description
The vulnerability allows a remote attacker to gain access to sensitive information or perform DoS attack on the target system.

The vulnerability exists due memory leak in ptp4l program when processing PTP one-step sync messages. A remote attacker can send specially crafted one-step sync messages to the system, force the application to leak memory and perform denial of service attack or gain access to sensitive information.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

linuxptp: 2.0 - 3.1

---

External links
https://seclists.org/oss-sec/2021/q3/4
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3571

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.