CVE-2021-20322
HighCVSS 7.4Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization.
Risk Assessment
The risk affects confidentiality and possibly integrity, as software relying on UDP source port randomization is indirectly impacted, facilitating scanning and attacks on UDP services.
Recommendation
It is recommended to update the Linux kernel to a patched version and employ additional protection mechanisms such as firewalls.
Original NVD description (English source)
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.