CVE-2021-20322 Information disclosure in kernel

High 7.4 Published 18 Feb 2022 Updated 30 Jul 2026

Remote attackers can bypass UDP source port randomization to scan open ports, compromising confidentiality and potentially integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-20322?

CVE-2021-20322 is a high-severity vulnerability in Debian Debian Linux, published on 18 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Weakness: CWE-330

Which versions are affected by CVE-2021-20322?

It affects 21 products.

Linux distribution packages (25)

`kernel-livepatch-SLE15-SP2_Update_12` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`9-2.1`
`kernel-livepatch-SLE15-SP2_Update_13` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`9-2.1`
`kernel-livepatch-SLE15-SP2_Update_14` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`7-2.1`
`kernel-livepatch-SLE15-SP2_Update_16` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`7-2.1`
`kernel-livepatch-SLE15-SP2_Update_17` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`6-2.1`
`kernel-livepatch-SLE15-SP2_Update_18` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`5-2.1`
`kernel-livepatch-SLE15-SP2_Update_19` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`3-2.1`
`kernel-livepatch-SLE15-SP2_Update_20` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`3-2.1`
`kernel-livepatch-SLE15-SP2_Update_21` SUSE:Linux Enterprise Live Patching 15 SP2	All versions	`2-2.1`
`kernel-livepatch-SLE15-SP3_Update_1` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`7-2.1`
`kernel-livepatch-SLE15-SP3_Update_2` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`7-2.1`
`kernel-livepatch-SLE15-SP3_Update_3` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`7-2.1`
`kernel-livepatch-SLE15-SP3_Update_4` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`6-2.1`
`kernel-livepatch-SLE15-SP3_Update_5` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`5-2.1`
`kernel-livepatch-SLE15-SP3_Update_6` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`3-2.1`
`kernel-livepatch-SLE15-SP3_Update_7` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`3-2.1`
`kernel-livepatch-SLE15-SP3_Update_9` SUSE:Linux Enterprise Live Patching 15 SP3	All versions	`2-2.1`
`kgraft-patch-SLE12-SP3_Update_37` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`13-2.2`
`kgraft-patch-SLE12-SP3_Update_38` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`12-2.2`
`kgraft-patch-SLE12-SP3_Update_39` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`9-2.1`
`kgraft-patch-SLE12-SP3_Update_40` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`6-2.1`
`kgraft-patch-SLE12-SP3_Update_37` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`13-2.2`
`kgraft-patch-SLE12-SP3_Update_38` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`12-2.2`
`kgraft-patch-SLE12-SP3_Update_39` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`9-2.1`
`kgraft-patch-SLE12-SP3_Update_40` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`6-2.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Linux kernel, Netapp Active Iq Unified Manager, Netapp Aff A700s Firmware, Netapp Aff Baseboard Management Controller Firmware and 15 more.

How do I fix CVE-2021-20322?

Apply the vendor's patch.

Is CVE-2021-20322 being exploited?

There is no known exploitation of CVE-2021-20322 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-20322, GHSA-x37m-35qq-p254, SUSE-SU-2021:4057-1, SUSE-SU-2021:4075-1, UBUNTU-CVE-2021-20322.