Vulnerability Details : CVE-2021-3905
Potential exploit
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Products affected by CVE-2021-3905
- cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-3905
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3905
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-3905
-
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2021-3905
-
https://ubuntu.com/security/CVE-2021-3905
CVE-2021-3905 | UbuntuPatch;Third Party Advisory
-
https://github.com/openvswitch/ovs-issues/issues/226
ipf memleak · Issue #226 · openvswitch/ovs-issues · GitHubExploit;Issue Tracking;Patch;Third Party Advisory
-
https://access.redhat.com/security/cve/CVE-2021-3905
CVE-2021-3905- Red Hat Customer PortalThird Party Advisory
-
https://security.gentoo.org/glsa/202311-16
Open vSwitch: Multiple Vulnerabilities (GLSA 202311-16) — Gentoo security
-
https://bugzilla.redhat.com/show_bug.cgi?id=2019692
2019692 – (CVE-2021-3905) CVE-2021-3905 openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packetsIssue Tracking;Patch;Third Party Advisory
-
https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349
ipf: release unhandled packets from the batch · openvswitch/ovs@803ed12 · GitHubPatch;Third Party Advisory
Jump to