CVE-2021-3905

NameCVE-2021-3905
DescriptionA memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openvswitch (PTS)buster2.10.7+ds1-0+deb10u1fixed
buster (security)2.10.7+ds1-0+deb10u5fixed
bullseye2.15.0+ds1-2+deb11u4fixed
bullseye (security)2.15.0+ds1-2+deb11u5fixed
bookworm3.1.0-2fixed
bookworm (security)3.1.0-2+deb12u1fixed
trixie3.3.0~git20240118.e802fe7-3fixed
sid3.3.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openvswitchsource(unstable)(not affected)

Notes

- openvswitch <not-affected> (Vulnerable code introduced later)
https://github.com/openvswitch/ovs-issues/issues/226
Introduced by: https://github.com/openvswitch/ovs/commit/640d4db788eda96bb904abcfc7de2327107bafe1 (v2.16.0)
Fixed by: https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349

Search for package or bug name: Reporting problems