In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
Fix
Public exploits 1
- benschlueter/CVE-2021-33624 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49db Patch, Third Party Advisory
- https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49db Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.7 · linux, debianNVD modified 2026-10-08 21:17
Affected (CPE criteria) 2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
References 9
- http://www.openwall.com/lists/oss-security/2021/06/21/1 Exploit, Mailing List, Third Party Advisory
- https://github.com/benschlueter/CVE-2021-33624
- https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49db Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html Issue Tracking, Third Party Advisory
- https://www.usenix.org/conference/usenixsecurity21/presentation/kirzner Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/06/21/1 Exploit, Mailing List, Third Party Advisory
- https://github.com/torvalds/linux/commit/9183671af6dbf60a1219371d4ed73e23f43b49db Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html Issue Tracking, Third Party Advisory
- https://www.usenix.org/conference/usenixsecurity21/presentation/kirzner Third Party Advisory