CVE-2021-31400 Denial of service in n/a
A flaw in the TCP out-of-band data processing allows remote attackers to cause a denial of service via infinite loop or device reset.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-31400?
CVE-2021-31400 is a high-severity denial of service vulnerability in n/a, published on 19 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing function invokes a panic function if the pointer to the end of the out-of-band data points outside of the TCP segment's data. If the panic function hadn't a trap invocation removed, it will enter an infinite loop and therefore cause DoS (continuous loop or a device reset).
Weakness: CWE-835
Which versions are affected by CVE-2021-31400?
It affects 1 product.
Products include Hcc-Embedded Nichestack.
How do I fix CVE-2021-31400?
No fix has been published for CVE-2021-31400 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-31400 being exploited?
There is no known exploitation of CVE-2021-31400 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h52p-pmhh-x2jv.