CVE-2021-3570

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	linuxptp	linuxptp 3.1.1, linuxptp 2.0.1, linuxptp 1.9.3, linuxptp 1.8.1, linuxptp 1.7.1, linuxptp 1.6.1, linuxptp 1.5.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1966240Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00025.htmlThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/
https://www.debian.org/security/2021/dsa-4938Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1966240Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00025.htmlThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHRUVSDP673LXJ5HGIPQPWPIYUPWYQA7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUBKTRCMJ6VKS7DIBSZQB4ATSKVCJYXJ/
https://www.debian.org/security/2021/dsa-4938Third Party Advisory

Timeline

Published: Jul 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-35717.1A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent CVE-2021-35725.7A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue t CVE-2021-35736.4A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or CVE-2021-35743.3A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.CVE-2021-35757.8A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker c CVE-2021-35767.8Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevat CVE-2021-35778.8An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an att CVE-2021-35787.8A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an ar CVE-2021-35797.8Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint S CVE-2021-35807.5A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provi CVE-2021-35818.8Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Length Value (CWE-805).CVE-2021-35826.5A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" co