CVE-2021-20322: Debian Linux

High severity, CVSS 7.4. EPSS: 6.9% chance of exploitation in the next 30 days.

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Affected products

  • Debian Debian Linux: version 9.0 only; version 10.0 only
  • Fedoraproject Fedora: version 34 only
  • Linux Linux Kernel: from 4.15, before 4.19.215 (fixed in 4.19.215); from 4.20, before 5.4.157 (fixed in 5.4.157); from 5.5, before 5.10.62 (fixed in 5.10.62); from 5.11, before 5.13.14 (fixed in 5.13.14)
  • Netapp Active Iq Unified Manager: affected versions not specified
  • Netapp Aff a700s Firmware: affected versions not specified
  • Netapp Aff Baseboard Management Controller Firmware: affected versions not specified
  • Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.1
  • Netapp Fas Baseboard Management Controller Firmware: affected versions not specified
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Netapp Hci Compute Node Firmware: affected versions not specified
  • Netapp Solidfire, Enterprise Sds & Hci Storage Node: affected versions not specified
  • Netapp Solidfire & Hci Management Node: affected versions not specified
  • Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
  • Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.1 only
  • Oracle Communications Cloud Native Core Policy: version 22.2.0 only

Published 2022-02-18. Last modified 2026-07-30.