CVE-2021-20322

HighCVSS 7.4/10Last modified Jul 30, 2026

Description

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-330

Affected software

VendorProductVersions
n/akernel>= 4.15, < 4.19.215; >= 4.20, < 5.4.146; >= 5.5, < 5.10.65; >= 5.11, < 5.13.17; >= 5.14, < 5.14.4

References

Timeline

Published
Feb 18, 2022
Last modified
Jul 30, 2026
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-203236.1A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.CVE-2021-203259.8Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securitCVE-2021-203266.5A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versioCVE-2021-203276.8A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. ThisCVE-2021-203286.8Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification CVE-2021-203296.5Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user couldCVE-2021-20334.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are afCVE-2021-203306.5An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resuCVE-2021-203314.9Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener confiCVE-2021-203324.4Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring evenCVE-2021-203335.3Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. CVE-2021-203347.8A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the pr