CVE-2021-20322

What it actually does

The flaw allows an off-path attacker to inject crafted ICMP fragment-needed or redirect messages that leak whether a UDP destination port is open or closed, defeating the kernel's source port randomization for UDP sockets.

Why it matters to the business

Attackers can silently map exposed UDP services across an organization's network, increasing the chance of targeted follow-on attacks against internal applications and data flows that rely on UDP.

How an attack unfolds

An attacker on the same network path sends spoofed ICMP error packets referencing a victim's UDP flow; the kernel's flawed handling reveals open ports without requiring the attacker to be on the return path of the original UDP traffic.

How to fix it

Upgrade the Linux kernel on all affected systems to a version containing the ICMP error processing fix; apply vendor-supplied updates for Fedora, Debian, and NetApp products as they become available; until patches can be deployed, consider network-level filtering of ICMP type 3 code 4 and redirect messages where operationally feasible.

How to confirm the fix worked

After patching, verify the kernel version string matches the vendor's fixed release, re-run UDP port scans from an off-path vantage point to confirm randomization is again effective, and review system logs for any residual ICMP error handling anomalies.

Typical attack path

1. Identify a target host and a range of UDP ports of interest
2. Craft and transmit spoofed ICMP 'fragmentation needed' or 'redirect' packets referencing the victim's 5-tuple
3. Observe kernel responses or timing side-effects that disclose whether the destination port is listening
4. Use discovered open ports to launch subsequent reconnaissance or exploitation against the exposed UDP services

How to detect it

Look in network flow logs and host firewall logs for sequences of ICMP type 3 code 4 or redirect packets followed by unexpected UDP traffic from previously unknown sources; correlate with kernel audit records showing rapid port-probing behavior.

What your security team should do

• Prioritize kernel updates on internet-facing and high-value internal systems within the next maintenance window
• Add UDP port randomization effectiveness tests to regular network scanning procedures
• Review and tighten egress ICMP filtering rules at network boundaries
• Monitor vendor advisories for the listed NetApp and distribution packages