A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect)…
Priority MEDIUM 42CWE-330Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 8 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.
Why it matters now
EPSS 0.06902 94th percentileScored 2026-11-07
Fix Partial kernel: 4.19.215, 5.4.146, 5.10.65 +2Red Hat: 4 advisoriesRed Hat: 8 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | kernel | 4.15 to before 4.19.215; 4.20 to before 5.4.146; 5.5 to before 5.10.65; 5.11 to before 5.13.17; 5.14 to before 5.14.4 | 4.19.215, 5.4.146, 5.10.65, 5.13.17, 5.14.4 | Patch available | CNA |
- kernel Vendor— Affected 4.15 to before 4.19.215; 4.20 to before 5.4.146; 5.5 to before 5.10.65; 5.11 to before 5.13.17; 5.14 to before 5.14.4 Fixed in 4.19.215, 5.4.146, 5.10.65, 5.13.17, 5.14.4 Patch available CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.15 to before 4.19.215; 4.20 to before 5.4.157; 5.5 to before 5.10.62; 5.11 to before 5.13.14 | Vulnerable | Linux |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.70.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:fas_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_baseboard_management_controller:8300:*:*:*:*:*:*:* | 8300 | Running on | NetApp |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.15 to before 4.19.215; 4.20 to before 5.4.157; 5.5 to before 5.10.62; 5.11 to before 5.13.14 Vulnerable ·Linux
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.70.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:fas_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_baseboard_management_controller:8300:*:*:*:*:*:*:* Versions 8300 Running on ·NetApp
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:fas_baseboard_management_controller:8700:*:*:*:*:*:*:* | 8700 | Running on | NetApp |
| cpe:2.3:o:netapp:aff_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_baseboard_management_controller:a400:*:*:*:*:*:*:* | a400 | Running on | NetApp |
| cpe:2.3:o:netapp:aff_a700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_a700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* | 22.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:* | 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:* | 22.2.0 | Vulnerable | Oracle |
- cpe:2.3:h:netapp:fas_baseboard_management_controller:8700:*:*:*:*:*:*:* Versions 8700 Running on ·NetApp
- cpe:2.3:o:netapp:aff_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_baseboard_management_controller:a400:*:*:*:*:*:*:* Versions a400 Running on ·NetApp
- cpe:2.3:o:netapp:aff_a700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_a700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:* Versions 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
Remediation
- Fix · CNA kernel Fixed in 4.19.215, 5.4.146, 5.10.65, 5.13.17, 5.14.4
Red Hat 4 advisories
- RHSA-2022:4835 Released 2022-05-31 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux NFV EUS (v.8.4) kernel-rt-4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-core-4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-debug-4.18.0-305.49.1.rt7.121.el8_4 +9
- Red Hat Enterprise Linux RT EUS (v.8.4) kernel-rt-4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-core-4.18.0-305.49.1.rt7.121.el8_4, kernel-rt-debug-4.18.0-305.49.1.rt7.121.el8_4 +7
- RHSA-2022:4829 Released 2022-05-31 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS EUS (v.8.4) bpftool-4.18.0-305.49.1.el8_4, kernel-4.18.0-305.49.1.el8_4, kernel-abi-stablelists-4.18.0-305.49.1.el8_4 +19
- Red Hat Enterprise Linux CRB EUS (v.8.4) kernel-tools-libs-devel-4.18.0-305.49.1.el8_4
- RHSA-2022:1988 Released 2022-05-10 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-372.9.1.el8, kernel-4.18.0-372.9.1.el8, kernel-abi-stablelists-4.18.0-372.9.1.el8 +19
- Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-372.9.1.el8
Show 1 more Red Hat advisories
- RHSA-2022:1975 Released 2022-05-10 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-372.9.1.rt7.166.el8, kernel-rt-core-4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-4.18.0-372.9.1.rt7.166.el8 +9
- Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-372.9.1.rt7.166.el8, kernel-rt-core-4.18.0-372.9.1.rt7.166.el8, kernel-rt-debug-4.18.0-372.9.1.rt7.166.el8 +7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:1988 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.4) | Fixed | RHSA-2022:4829 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2022:1988 |
| Red Hat Enterprise Linux CRB EUS (v.8.4) | Fixed | RHSA-2022:4829 |
| Red Hat Enterprise Linux NFV (v. 8) | Fixed | RHSA-2022:1975 |
| Red Hat Enterprise Linux NFV EUS (v.8.4) | Fixed | RHSA-2022:4835 |
| Red Hat Enterprise Linux RT (v. 8) | Fixed | RHSA-2022:1975 |
| Red Hat Enterprise Linux RT EUS (v.8.4) | Fixed | RHSA-2022:4835 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20322
- 2026-10-03 Alias added: GHSA-x37m-35qq-p254
References
Patch 4
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.15-rc6&id=4785305c05b25a242e5314cc821f54ade4c18810
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.15-rc6&id=6457378fe796815c973f631a1904e147d6ee33b1
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/ipv4/route.c?h=v5.15-rc6&id=67d6d681e15b578c1725bad8ad079e05d1c48a8e
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/ipv6/route.c?h=v5.15-rc6&id=a00df2caffed3883c341d5685f830434312e4a43
Sources
- CVE-2021-20322 · CVE Program
- CVE-2021-20322 · NVD
- FIRST EPSS
- GHSA-x37m-35qq-p254 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-20322 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences