CVE-2021-20322: 
Linux Kernel vulnerability analysis and mitigation

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was discovered that allows the ability to quickly scan open UDP ports. This vulnerability, identified as CVE-2021-20322, enables an off-path remote user to effectively bypass the source port UDP randomization. The vulnerability was first reported in December 2020 and affects Linux kernel versions through 5.14.21 (CVE Mitre, NVD).

The vulnerability exists in the Linux kernel's ICMP error processing mechanism, specifically affecting how the system handles ICMP fragment needed and ICMP redirect packets. The issue has been assigned a CVSS score of 7.4 (HIGH) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating a network-exploitable vulnerability with high impact on confidentiality and integrity (NetApp Advisory).

The highest threat from this vulnerability is to confidentiality and possibly integrity, as software that relies on UDP source port randomization is indirectly affected. The vulnerability allows attackers to quickly discover which UDP ports a system is using, making it easier to conduct DNS poisoning attacks against the target system (Debian Security Advisory).

The vulnerability was fixed in Linux kernel version 5.15-rc1 through multiple patches that improve the handling of ICMP errors. The fixes include changes to the hash functions used in IPv4 and IPv6 implementations, replacing Jenkins Hash with siphash, and making the exception cache less predictable (Linux Kernel Commit).