CVE-2021-33624
Moderate
CVE-2021-33624
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
Exploit probability
0.9%
Published
June 23, 2021
Required by
Not available
Last source change
April 16, 2026
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
PUB-A-192972537
View original source
Open Source Vulnerabilities
CVE-2021-33624
View original source
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
05 / REFERENCES
Further evidence
- https://android.googlesource.com/kernel/common/+/5fc6ed1831ca5
- https://source.android.com/security/bulletin/2022-03-01
- http://www.openwall.com/lists/oss-security/2021/06/21/1
- https://github.com/benschlueter/CVE-2021-33624
- https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49db
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
- https://www.usenix.org/conference/usenixsecurity21/presentation/kirzner