CVE-2021-3571
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a...
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
CVE-2021-3571- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:P - Weakness
- CWE-119, CWE-125
- Updated
- 2026-11-02
CVE List No score
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
CVE-2021-3571- Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2021-26881 No score
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
EUVD-2021-26881- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3v9q-m45q-4cr7
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a...
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
GHSA-3v9q-m45q-4cr7- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-119, CWE-125
- Updated
- 2026-11-02
OSV
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
CVE-2021-3571- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3571
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
DEBIAN-CVE-2021-3571- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2021-1267
linuxptp security update
Linuxptp is an implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Programming Interfaces (API) offered by the Linux kernel. Supporting legacy APIs and other platforms is not a goal.
Security Fix(es):
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.(CVE-2021-3571)
- Record
OESA-2021-1267- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4321
Red Hat Security Advisory: linuxptp security, bug fix, and enhancement update
- Record
RHSA-2021:4321- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2021:4321
Moderate: linuxptp security, bug fix, and enhancement update
The linuxptp packages provide Precision Time Protocol (PTP) implementation for Linux according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Programming Interfaces (API) offered by the Linux kernel.
The following packages have been upgraded to a later upstream version: linuxptp (3.1.1). (BZ#1895005)
Security Fix(es):
- linuxptp: wrong length of one-step follow-up in transparent clock (CVE-2021-3571)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.
- Record
RLSA-2021:4321- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3571
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
- Record
UBUNTU-CVE-2021-3571- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2021:4321 No score
Moderate: linuxptp security, bug fix, and enhancement update
The linuxptp packages provide Precision Time Protocol (PTP) implementation for Linux according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Programming Interfaces (API) offered by the Linux kernel.
The following packages have been upgraded to a later upstream version: linuxptp (3.1.1). (BZ#1895005)
Security Fix(es):
- linuxptp: wrong length of one-step follow-up in transparent clock (CVE-2021-3571)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2021:4321- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxptpAlmaLinux:8 |
before 3.1.1-1.el8 | 3.1.1-1.el8 |
linuxptpDebian:12 |
before 3.1-2.1 | 3.1-2.1 |
linuxptpDebian:13 |
before 3.1-2.1 | 3.1-2.1 |
linuxptpDebian:14 |
before 3.1-2.1 | 3.1-2.1 |
linuxptpopenEuler:20.03-LTS-SP1 |
before 2.0-4.oe1 | 2.0-4.oe1 |
linuxptpRed Hat:enterprise_linux:8::appstream |
before 0:3.1.1-1.el8 | 0:3.1.1-1.el8 |
linuxptp-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.1.1-1.el8 | 0:3.1.1-1.el8 |
linuxptp-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.1.1-1.el8 | 0:3.1.1-1.el8 |
linuxptpRocky Linux:8 |
before 0:3.1.1-1.el8 | 0:3.1.1-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3571 is a high vulnerability (CVSS 7.1) in Linuxptp Project Linuxptp, published July 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in linuxptp 3.1.1-1.el8.
References
bugzilla.redhat.com/show_bug.cgi?id=1966241
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ
nvd.nist.gov/vuln/detail/CVE-2021-3571
Show 14 moreShow less
github.com/advisories/GHSA-3v9q-m45q-4cr7
vulners.com/cve/CVE-2021-3571
security-tracker.debian.org/tracker/CVE-2021-3571
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1267
access.redhat.com/errata/RHSA-2021:4321
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4321.json
cve.org/CVERecord?id=CVE-2021-3571
errata.rockylinux.org/RLSA-2021:4321
ubuntu.com/security/CVE-2021-3571
openwall.com/lists/oss-security/2021/07/06/1