CVE-2021-33624
⚪ Do wiadomości
Błąd w weryfikatorze BPF w jądrze Linux umożliwia nieuprawnionym programom odczyt pamięci.
CVSS
4.7
EPSS
0.9%
Exploit
poc
Vendor
debian
Opis źródłowy (NVD)
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 4.7 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.9% |
| Opublikowano (NVD) | 2021-06-23 16:15:07 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 21:17:35 UTC |
Referencje
- http://www.openwall.com/lists/oss-security/2021/06/21/1 ([email protected]) [Exploit, Mailing List, Third Party Advisory]
- https://github.com/benschlueter/CVE-2021-33624 ([email protected])
- https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49db ([email protected]) [Patch, Third Party Advisory]
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html ([email protected]) [Issue Tracking, Third Party Advisory]
- https://www.usenix.org/conference/usenixsecurity21/presentation/kirzner ([email protected]) [Third Party Advisory]