CVE-2021-45486: In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small

Low severity · published Dec 25, 2021

CVE-2021-45486

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small

3.5

CVSS

0.4%

EPSS

On KEV

Description

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector

Adjacent

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 34% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

before 5.12.4 · source: NVD

Communications Cloud Native Core Binding Support Function · Oracle

22.1.3 · source: NVD

Communications Cloud Native Core Network Exposure Function · Oracle

22.1.1 · source: NVD

Communications Cloud Native Core Policy · Oracle

22.2.0 · source: NVD

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-45486

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-45486

Technical Description

https://arxiv.org/pdf/2112.09604.pdf

Release Notes

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4

Patch

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c?id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba

Patch

https://www.oracle.com/security-alerts/cpujul2022.html