CVE-2021-20322: Linux Kernel Information Disclosure Flaw

CVE-2021-20322 Overview

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Critical Impact

Off-path attackers can bypass UDP source port randomization, enabling rapid UDP port scanning and potentially compromising the confidentiality and integrity of systems relying on UDP port randomization for security.

Affected Products

• Linux Kernel (multiple versions)
• Fedora 34
• Debian Linux 9.0 and 10.0
• NetApp Active IQ Unified Manager, E-Series SANtricity OS Controller
• NetApp SolidFire, Enterprise SDS & HCI Storage/Management Nodes
• NetApp FAS/AFF Baseboard Management Controller firmware
• NetApp H-Series (H700S, H700E, H500S, H500E, H410S, H300E, H300S)
• NetApp HCI Compute Node firmware
• Oracle Communications Cloud Native Core (Binding Support Function 22.1.3, Network Exposure Function 22.1.1, Policy 22.2.0)

Discovery Timeline

• 2022-02-18 - CVE CVE-2021-20322 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-20322

Vulnerability Analysis

This vulnerability exists in the Linux kernel's ICMP error handling mechanism. The flaw allows off-path remote attackers to exploit how the kernel processes ICMP "fragment needed" and ICMP redirect messages to infer information about open UDP ports on a target system. By analyzing the responses to specially crafted ICMP packets, attackers can effectively bypass the security provided by UDP source port randomization—a mechanism designed to make it difficult for attackers to predict or guess the source ports used by UDP-based applications.

The vulnerability is particularly concerning because it creates a side-channel that can be exploited without requiring the attacker to be in the direct network path between communicating hosts. This off-path attack capability significantly expands the potential attack surface, as adversaries do not need to perform traditional man-in-the-middle positioning.

Root Cause

The root cause lies in the insufficient randomization (CWE-330) in the Linux kernel's handling of ICMP error messages related to UDP communications. Specifically, the kernel's route handling code in both IPv4 (net/ipv4/route.c) and IPv6 (net/ipv6/route.c) did not adequately protect against information leakage when processing ICMP fragment needed and ICMP redirect messages. This weakness allows attackers to correlate ICMP responses with UDP port states, effectively defeating the source port randomization that many UDP-based protocols rely upon for security.

Attack Vector

The attack is conducted remotely over the network without requiring authentication or user interaction. An off-path attacker sends specially crafted ICMP packets to a target system and analyzes the responses to determine which UDP ports are open. The attack exploits the predictable behavior of the kernel when handling ICMP errors, allowing rapid enumeration of UDP services.

The vulnerability affects confidentiality by revealing information about open UDP ports and potentially impacts integrity because protocols relying on UDP source port randomization (such as DNS) may become vulnerable to cache poisoning or similar attacks once the port randomization is bypassed.

Detection Methods for CVE-2021-20322

Indicators of Compromise

• Unusual volumes of inbound ICMP "fragment needed" (Type 3, Code 4) or ICMP redirect messages from external sources
• Unexpected patterns in UDP connection logs suggesting port enumeration activity
• Anomalous network traffic patterns involving correlated ICMP and UDP packets from unknown sources

Detection Strategies

• Monitor network traffic for high rates of ICMP error messages, particularly Type 3 (Destination Unreachable) Code 4 (Fragmentation Needed) and ICMP redirect packets
• Implement intrusion detection rules to flag suspicious ICMP traffic patterns that may indicate port scanning attempts
• Utilize kernel audit logging to track ICMP error processing and identify potential exploitation attempts

Monitoring Recommendations

• Deploy network-based sensors to analyze ICMP traffic patterns at network boundaries
• Configure host-based monitoring to alert on unusual UDP port access patterns or service enumeration
• Review system logs for evidence of UDP-based service reconnaissance activity

How to Mitigate CVE-2021-20322

Immediate Actions Required

• Update the Linux kernel to version 5.15 or later, which contains the patches addressing this vulnerability
• Apply vendor-specific patches from Debian, Fedora, NetApp, and Oracle as appropriate for your environment
• Review and restrict ICMP traffic at network boundaries where operationally feasible

Patch Information

Multiple patches have been committed to the Linux kernel to address this vulnerability. The fixes are available in the v5.15-rc6 release and subsequent versions:

• Linux Commit #4785305 - Core fix for ICMP processing
• Linux Commit #6457378 - Additional hardening
• IPv4 Route.c Commit - IPv4 route handling fix
• IPv6 Route.c Commit - IPv6 route handling fix

Distribution-specific advisories: Debian Security Advisory DSA-5096, Debian LTS Announcement, NetApp Security Advisory, Oracle Security Alert July 2022.

Workarounds

• Implement strict ICMP filtering at network perimeters to block or rate-limit ICMP fragment needed and redirect messages from untrusted sources
• Configure iptables or nftables rules to drop suspicious ICMP traffic patterns that may be used for exploitation
• Consider disabling ICMP redirect acceptance on affected systems using sysctl (net.ipv4.conf.all.accept_redirects=0)

# Configuration example - Disable ICMP redirect acceptance
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv4.conf.default.accept_redirects=0
sysctl -w net.ipv6.conf.all.accept_redirects=0
sysctl -w net.ipv6.conf.default.accept_redirects=0

# Make changes persistent across reboots
echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
echo "net.ipv6.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.accept_redirects = 0" >> /etc/sysctl.conf