CVE-2021-33630

NULL-ptr-deref in network sched

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C.

This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.

La vulnerabilidad de desreferencia de puntero NULL en el kernel openEuler en Linux (módulos de red) permite la manipulación de puntero. Esta vulnerabilidad está asociada con los archivos de programa net/sched/sch_cbs.C. Este problema afecta al kernel de openEuler: desde 4.19.90 antes de 4.19.90-2401.3.

A NULL pointer dereference flaw was found in the Linux kernel's network scheduler. This issue occurs when offloading is enabled, the cbs instance is not added to the list. The code also incorrectly handles the case when offload is disabled without removing the qdisc. This could allow a local user to cause a denial of service condition.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-05-28 CVE Reserved
2024-01-18 CVE Published
2024-02-08 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference

CAPEC

CAPEC-129: Pointer Manipulation

References (17)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/01/30/10
http://www.openwall.com/lists/oss-security/2024/01/30/3
http://www.openwall.com/lists/oss-security/2024/01/30/4
http://www.openwall.com/lists/oss-security/2024/01/30/5
http://www.openwall.com/lists/oss-security/2024/01/30/9
http://www.openwall.com/lists/oss-security/2024/01/31/2
http://www.openwall.com/lists/oss-security/2024/01/31/3
http://www.openwall.com/lists/oss-security/2024/02/02/6
http://www.openwall.com/lists/oss-security/2024/02/02/9
http://www.openwall.com/lists/oss-security/2024/02/03/1
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e8b9bfa110896f95d602d8c98d5f9d67e41d78c
https://gitee.com/src-openeuler/kernel/pulls/1389	Release Notes
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1030	2024-06-27
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1031	2024-06-27
https://access.redhat.com/security/cve/CVE-2021-33630	2020-04-28
https://bugzilla.redhat.com/show_bug.cgi?id=2261974	2020-04-28

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Huawei Search vendor "Huawei"		Openeuler Search vendor "Huawei" for product "Openeuler"				>= 4.19.90 < 4.19.90-2401.3 Search vendor "Huawei" for product "Openeuler" and version " >= 4.19.90 < 4.19.90-2401.3"		-		Affected