CVE-2021-45486
published 2021-12-25CVE-2021-45486: In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
PriorityP412low3.5CVSS 3.1
AVAACLPRLUINSUCLINAN
EPSS
0.37%
29.8th percentile
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.38-1 (bookworm) | linux 5.10.38-1 (bookworm) |
| linux | linux_kernel | < 5.12.4 | 5.12.4 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 4.4.0-223.256 | 4.4.0-223.256 |
| msrc | cbl2_kernel_5.15.2.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_kernel_5.10.88.1-2_on_cbl_mariner_1.0 | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_network_exposure_function | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
CVSS provenance
nvdv3.13.5LOWCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.02.7LOWAV:A/AC:L/Au:S/C:P/I:N/A:N
osv5.3MEDIUM
vendor_ubuntu5.3MEDIUM
vendor_debian3.5LOW
vendor_msrc3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-04-01·CVSS 5.3
CVE-2021-42739 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the VFIO PCI driver in the Linux kernel did not
properly handle attempts to access disabled memory spaces. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2020-12888)
Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation did
not properly verify certain fragmented frames. A physically proximate
attacker could possibly use this issue to inject or decrypt packets.
(CVE-2020-26141)
Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation
accepted plaintext fragments in certain situations. A physically proximate
attacker could use this issue to inject packets. (CVE-2020-26145)
It was discovered that a race c
Microsoft
In the IPv4 implementation in the Linux kernel before 5.12.4 net/ipv4/route.c has an information leak because the hash table is very small.
vendor_msrc·2021-12-14·CVSS 3.5
CVE-2021-45486 [LOW] CWE-327 In the IPv4 implementation in the Linux kernel before 5.12.4 net/ipv4/route.c has an information leak because the hash table is very small.
In the IPv4 implementation in the Linux kernel before 5.12.4 net/ipv4/route.c has an information leak because the hash table is very small.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Custom
Red Hat
kernel: information leak in the IPv4 implementation
vendor_redhat·2021-03-24·CVSS 3.5
CVE-2021-45486 [LOW] CWE-497 kernel: information leak in the IPv4 implementation
kernel: information leak in the IPv4 implementation
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
An information leak flaw was found in the Linux kernel’s IPv4 implementation in the ip_rt_init in net/ipv4/route.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: kernel (Red Hat Enterprise Linux 6) - Affected
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: k
Debian
CVE-2021-45486: linux - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c h...
vendor_debian·2021·CVSS 3.5
CVE-2021-45486 [LOW] CVE-2021-45486: linux - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c h...
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
Scope: local
bookworm: resolved (fixed in 5.10.38-1)
bullseye: resolved (fixed in 5.10.38-1)
forky: resolved (fixed in 5.10.38-1)
sid: resolved (fixed in 5.10.38-1)
trixie: resolved (fixed in 5.10.38-1)
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2022-04-01·CVSS 5.3
CVE-2020-12888 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
It was discovered that the VFIO PCI driver in the Linux kernel did not
properly handle attempts to access disabled memory spaces. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2020-12888)
Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation did
not properly verify certain fragmented frames. A physically proximate
attacker could possibly use this issue to inject or decrypt packets.
(CVE-2020-26141)
Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation
accepted plaintext fragments in certain situations. A physically proximate
attacker could use this issue to inject packets. (CVE-2020-26145)
It was discovered that a race condition existed in the Atheros Ath9k Wi
GHSA
GHSA-jr67-68pw-5xqf: In the IPv4 implementation in the Linux kernel before 5
ghsa_unreviewed·2021-12-26
CVE-2021-45486 [MEDIUM] CWE-327 GHSA-jr67-68pw-5xqf: In the IPv4 implementation in the Linux kernel before 5
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
OSV
CVE-2021-45486: In the IPv4 implementation in the Linux kernel before 5
osv·2021-12-25·CVSS 3.5
CVE-2021-45486 [LOW] CVE-2021-45486: In the IPv4 implementation in the Linux kernel before 5
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.
No detection rules found.
No public exploits indexed.
https://arxiv.org/pdf/2112.09604.pdfhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c?id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eebahttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://arxiv.org/pdf/2112.09604.pdfhttps://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/ipv4/route.c?id=aa6dd211e4b1dde9d5dc25d699d35f789ae7eebahttps://www.oracle.com/security-alerts/cpujul2022.html
2021-12-25
Published