CVE-2021-3744: debian debian_linux
Vulnerability summary
CVE-2021-3744 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 45% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 32 · Related 26Timeline
- 04-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.53% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu63 products
- linux< 4.15.0-163.171 | < 5.4.0-91.102
- linux-aws< 4.15.0-1116.123 | < 5.4.0-1060.63
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11< 5.11.0-1022.23~20.04.1
- linux-aws-5.3All versions (No fix recorded)
Redhat17 products
- build_of_quarkus2.0
- codeready_linux_builder8.0
- codeready_linux_builder_eus8.6
- codeready_linux_builder_for_power_little_endian8.0
- codeready_linux_builder_for_power_little_endian_eus8.6
Oracle3 products
Debian2 products
- linux< 5.14.12-1
- debian_linuxEOL9.0 | 10.0
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Linux1 product
- linux_kernel< 5.15 | 5.15 | 5.15:rc1 | 5.15:rc2 | 5.15:rc3
6 vendors · 87 products
References
21 links- www.openwall.com/lists/oss-security/2021/09/14/1Mailing ListX Refsource MLISTExploitThird Party Advisory
- github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680X Refsource MISCPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing ListX Refsource MLISTThird Party Advisory
