CVE-2021-3905 is a memory leak vulnerability in Open vSwitch (OVS) affecting canonical, fedoraproject, openvswitch, and redhat products, specifically during userspace IP fragmentation processing. With a CVSS score of 7.5 (High), this flaw allows an unauthenticated attacker to remotely exhaust available memory by continuously sending packet fragments, leading to a denial of service. Despite its high severity and potential for impact, there is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.17.0CPE matchmatch criteria | cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:* | ||
21.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Aug 9, 2022openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packets
Sep 29, 2021