CVE-2021-33624

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.

• CWE-843

• http://www.openwall.com/lists/oss-security/2021/06/21/1Exploit, Mailing List, Third Party Advisory
• https://github.com/benschlueter/CVE-2021-33624
• https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49dbPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlIssue Tracking, Third Party Advisory
• https://www.usenix.org/conference/usenixsecurity21/presentation/kirznerThird Party Advisory
• http://www.openwall.com/lists/oss-security/2021/06/21/1Exploit, Mailing List, Third Party Advisory
• https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49dbPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/10/msg00010.htmlIssue Tracking, Third Party Advisory
• https://www.usenix.org/conference/usenixsecurity21/presentation/kirznerThird Party Advisory

Published

Jun 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33617Zoho ManageEngine Password Manager Pro before 11.2 11200 all…5.3
• CVE-2021-33618Dolibarr ERP and CRM 13.0.2 allows XSS via object details, a…6.1
• CVE-2021-33620Squid before 4.15 and 5.x before 5.0.6 allows remote servers…6.5
• CVE-2021-33621The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x be…8.8
• CVE-2021-33622Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO befor…9.8
• CVE-2021-33623The trim-newlines package before 3.0.1 and 4.x before 4.0.1 …7.5
• CVE-2021-33625An issue was discovered in Kernel 5.x in Insyde InsydeH2O, a…7.5
• CVE-2021-33626A vulnerability exists in SMM (System Management Mode) branc…7.8
• CVE-2021-33627An issue was discovered in Insyde InsydeH2O Kernel 5.0 befor…8.2
• CVE-2021-33629isula-build before 0.9.5-6 can cause a program crash, when b…7.5
• CVE-2021-33630NULL Pointer Dereference vulnerability in openEuler kernel o…5.5
• CVE-2021-33631Integer Overflow or Wraparound vulnerability in openEuler ke…7.8