CVE-2021-45486

LOW
Published Dec 25, 20214y ago · Modified Jun 17, 20262w ago
3.5 CVSS 3.1
Low
Find Similar
Published Dec 25, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.

CVSS Details

Base Score
3.5
Exploitability
2.1
Impact
1.4
Vector string
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Adjacent
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-327

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel* <5.12.4
oraclecommunications_cloud_native_core_binding_support_function22.1.3any
oraclecommunications_cloud_native_core_network_exposure_function22.1.1any
oraclecommunications_cloud_native_core_policy22.2.0any

References 4

  • arxiv.org https://arxiv.org/pdf/2112.09604.pdf
    Technical DescriptionThird Party Advisory
  • cdn.kernel.org https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4
    Release NotesVendor Advisory
  • git.kernel.org https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c?id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba
    PatchVendor Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c?id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba
    PatchVendor Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory