CVE-2021-3655CWE-20CWE-909

CVE-2021-3655

Low · published August 6, 2021

CVSS v3.1
3.3
EPSS
0%
Percentile
22.4
In the wild
Unconfirmed
What it is

A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00308 · 22.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-909 · Missing Initialization of Resource
Published
2021-08-06T01:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel< 5.145.14
linux/linux_kernelall versions—
redhat/enterprise_linuxall versions—
debian/debian_linuxall versions—
References (6)
https://bugzilla.redhat.com/show_bug.cgi?id=1984024 · [email protected]https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html · [email protected]https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=1984024 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 05 AUG 20:48Z
    A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1
    cvelistv5