Homepage

Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package linuxptp-debugsource  (opens in a new tab)

Threat Intelligence

EPSS
1.9% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-LINUXPTPDEBUGSOURCE-1733332
  • published26 Jul 2021
  • disclosed5 Jul 2021
Report a new vulnerability Found a mistake?

Introduced: 5 Jul 2021

CVE-2021-3571  (opens in a new tab)
CWE-119  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linuxptp-debugsource package and not the linuxptp-debugsource package as distributed by RHEL.

A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.