SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-3905

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing.

HIGH 7.5EPSS 1.99%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

CVSS 3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.99% probability · 80th percentile
CISA KEV
Not listed
Weakness
CWE-401
Affected
openvswitch/openvswitch · redhat/enterprise linux fast datapath · canonical/ubuntu linux · fedoraproject/fedora
Source
secalert@redhat.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.