CVE-2021-44421

The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unauthorized information via side-channel analysis.

• CWE-203

• https://github.com/occlum/occlum/blob/821ea843ae21037e6cff5268306d2da1fb131552/src/libos/src/util/mem_util.rs#L130Exploit, Third Party Advisory
• https://github.com/occlum/occlum/blob/821ea843ae21037e6cff5268306d2da1fb131552/src/libos/src/util/mem_util.rs#L51Exploit, Third Party Advisory
• https://github.com/occlum/occlum/commit/36918e42bf6732c4d3996bc99eb013eb6b90b249Patch, Third Party Advisory
• https://github.com/occlum/occlum/compare/0.25.0...v0.26.0Third Party Advisory
• https://github.com/occlum/occlum/blob/821ea843ae21037e6cff5268306d2da1fb131552/src/libos/src/util/mem_util.rs#L130Exploit, Third Party Advisory
• https://github.com/occlum/occlum/blob/821ea843ae21037e6cff5268306d2da1fb131552/src/libos/src/util/mem_util.rs#L51Exploit, Third Party Advisory
• https://github.com/occlum/occlum/commit/36918e42bf6732c4d3996bc99eb013eb6b90b249Patch, Third Party Advisory
• https://github.com/occlum/occlum/compare/0.25.0...v0.26.0Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44416A denial of service vulnerability exists in the cgiserver.cg…7.7
• CVE-2021-44417A denial of service vulnerability exists in the cgiserver.cg…7.7
• CVE-2021-44418A denial of service vulnerability exists in the cgiserver.cg…7.7
• CVE-2021-44419A denial of service vulnerability exists in the cgiserver.cg…7.7
• CVE-2021-4442In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-44420In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 befo…7.3
• CVE-2021-44422An Improper Input Validation Vulnerability exists when readi…7.8
• CVE-2021-44423An out-of-bounds read vulnerability exists when reading a BM…7.8
• CVE-2021-44425An issue was discovered in AnyDesk before 6.2.6 and 6.3.x be…6.5
• CVE-2021-44426An issue was discovered in AnyDesk before 6.2.6 and 6.3.x be…8.8
• CVE-2021-44427An unauthenticated SQL Injection vulnerability in Rosario St…9.8
• CVE-2021-44428Pinkie 2.15 allows remote attackers to cause a denial of ser…7.5