{"id":"CVE-2021-3571","aliases":["ALSA-2021:4321","DEBIAN-CVE-2021-3571","EUVD-2021-26881","GHSA-3v9q-m45q-4cr7","OESA-2021-1267","RHSA-2021:4321","RLSA-2021:4321","UBUNTU-CVE-2021-3571"],"status":"published","title":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a...","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01895,"percentile":0.79792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125"],"published":"2021-07-05T00:00:00Z","modified":"2026-10-29T11:01:10Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"linuxptp","fixed_in":["3.1.1-1.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linuxptp","fixed_in":["3.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linuxptp","fixed_in":["3.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linuxptp","fixed_in":["3.1-2.1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"linuxptp","fixed_in":["2.0-4.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"linuxptp","fixed_in":["0:3.1.1-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"linuxptp-debuginfo","fixed_in":["0:3.1.1-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"linuxptp-debugsource","fixed_in":["0:3.1.1-1.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"linuxptp","fixed_in":["0:3.1.1-1.el8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-2.1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-4.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"linuxptp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"linuxptp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-1.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"linuxptp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-1.el8"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"linuxptp_project","product":"linuxptp"},{"vendor":"microsoft","product":"linuxptp"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966241","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3571","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/"},{"url":"https://github.com/advisories/GHSA-3v9q-m45q-4cr7"},{"url":"https://vulners.com/cve/CVE-2021-3571","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3571","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1267","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4321","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895005","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4321.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3571","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4321","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3571","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/07/06/1","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3571","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"published","published":"2021-07-09T10:33:09Z","modified":"2024-08-03T17:01:08.291Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26881","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"published","published":"2021-07-09T10:33:09Z","modified":"2024-08-03T17:01:08Z","updated_at":"2026-11-03T03:25:11.953192Z"}],"ghsa":[{"id":"GHSA-3v9q-m45q-4cr7","title":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a...","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"published","published":"2022-05-24T19:07:22Z","modified":"2023-01-28T05:08:35Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:44:37.39101Z"}],"nvd":[{"id":"CVE-2021-3571","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"published","published":"2021-07-09T11:15:08.96Z","modified":"2026-06-17T04:05:21.8Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"CVE-2021-3571","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"published","published":"2021-07-09T11:15:08.96Z","modified":"2026-10-24T10:30:40.565106791Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3571","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"published","published":"2021-07-09T11:15:08.96Z","modified":"2026-10-23T18:03:29.57983516Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1267","title":"linuxptp security update","description":"Linuxptp is an implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Programming Interfaces (API) offered by the Linux kernel. Supporting legacy APIs and other platforms is not a goal.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.(CVE-2021-3571)","status":"published","published":"2021-07-17T11:04:30Z","modified":"2026-08-18T01:15:49.226173234Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4321","title":"Red Hat Security Advisory: linuxptp security, bug fix, and enhancement update","status":"published","published":"2024-09-16T06:18:03Z","modified":"2025-11-22T12:26:35Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4321","title":"Moderate: linuxptp security, bug fix, and enhancement update","description":"The linuxptp packages provide Precision Time Protocol (PTP) implementation for Linux according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Programming Interfaces (API) offered by the Linux kernel. \n\nThe following packages have been upgraded to a later upstream version: linuxptp (3.1.1). (BZ#1895005)\n\nSecurity Fix(es):\n\n* linuxptp: wrong length of one-step follow-up in transparent clock (CVE-2021-3571)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:00:47Z","modified":"2026-02-05T06:00:07.137561Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-3571","description":"A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.","status":"withdrawn","published":"2021-07-05T00:00:00Z","modified":"2025-07-16T07:42:54.996458Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2021:4321","title":"Moderate: linuxptp security, bug fix, and enhancement update","description":"The linuxptp packages provide Precision Time Protocol (PTP) implementation for Linux according to IEEE standard 1588 for Linux. The dual design goals are to provide a robust implementation of the standard and to use the most relevant and modern Application Programming Interfaces (API) offered by the Linux kernel. \n\nThe following packages have been upgraded to a later upstream version: linuxptp (3.1.1). (BZ#1895005)\n\nSecurity Fix(es):\n\n* linuxptp: wrong length of one-step follow-up in transparent clock (CVE-2021-3571)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:00:47Z","modified":"2026-10-29T11:01:10.562277644Z","updated_at":"2026-11-02T15:27:51.196609Z"}]}}