CVE-2021-3744: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Linux Linux Kernel: before 5.15 (fixed in 5.15); version 5.15 only
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.1 only
• Oracle Communications Cloud Native Core Policy: version 22.2.0 only
• Red Hat Build Of Quarkus: version 2.0 only
• Red Hat Codeready Linux Builder: version 8.0 only
• Red Hat Codeready Linux Builder Eus: version 8.6 only
• Red Hat Codeready Linux Builder For Power Little Endian: version 8.0 only
• Red Hat Codeready Linux Builder For Power Little Endian Eus: version 8.6 only
• Red Hat Developer Tools: version 1.0 only
• Red Hat Enterprise Linux Eus: version 8.6 only
• Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.6 only
• Red Hat Enterprise Linux For Power Little Endian Eus: version 8.6 only
• Red Hat Enterprise Linux For Real Time: version 8 only; version 8.6 only
• Red Hat Enterprise Linux For Real Time For Nfv: version 8 only
• Red Hat Enterprise Linux For Real Time For Nfv Tus: version 8.6 only
• Red Hat Enterprise Linux Server Eus: version 8.6 only
• Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 8.6 only
• Red Hat Enterprise Linux Server Tus: version 8.6 only
• Red Hat Enterprise Linux Server Update Services For SAP Solutions: version 8.6 only
• Red Hat Virtualization Host: version 4.0 only

Published 2022-03-04. Last modified 2026-06-17.