CVE-2021-3655

LOW
Published Aug 5, 20214y ago · Modified Jun 17, 20262w ago
3.3 CVSS 3.1
Low
Find Similar
Published Aug 5, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.

CVSS Details

Base Score
3.3
Exploitability
1.8
Impact
1.4
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-20 Improper Input Validation Validation
CWE-909

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel* <5.14
linuxlinux_kernel5.14any
redhatenterprise_linux8.0any
debiandebian_linux9.0any

References 3

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1984024
    Issue TrackingPatchThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
    Mailing ListThird Party Advisory

Remediation

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1984024
    Issue TrackingPatchThird Party Advisory