{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2021-33630", "assignerOrgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2", "state": "PUBLISHED", "assignerShortName": "openEuler", "dateReserved": "2021-05-28T14:26:05.940Z", "datePublished": "2024-01-18T15:00:49.312Z", "dateUpdated": "2024-08-03T23:58:21.572Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://gitee.com/src-openeuler", "defaultStatus": "unaffected", "modules": ["network"], "packageName": "kernel", "platforms": ["Linux"], "product": "kernel", "programFiles": ["https://gitee.com/openeuler/kernel/blob/openEuler-1.0-LTS/net/sched/sch_cbs.c"], "repo": "https://gitee.com/src-openeuler/kernel", "vendor": "openEuler", "versions": [{"changes": [{"at": "b2239f607df25fc401179e6dd4b7406f942a7632 net/sched: cbs: Fix not adding cbs instance to list", "status": "unaffected"}], "lessThan": "4.19.90-2401.3", "status": "affected", "version": "4.19.90", "versionType": "git"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation.<p> This vulnerability is associated with program files <tt>net/sched/sch_cbs.C</tt>.</p><p>This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.</p>"}], "value": "NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C.\n\nThis issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.\n\n"}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129 Pointer Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2", "shortName": "openEuler", "dateUpdated": "2024-01-26T08:11:43.505Z"}, "references": [{"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1030"}, {"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1031"}, {"url": "https://gitee.com/src-openeuler/kernel/pulls/1389"}, {"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e8b9bfa110896f95d602d8c98d5f9d67e41d78c"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/3"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/4"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/5"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/9"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/10"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/31/3"}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/31/2"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/02/6"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/02/9"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/03/1"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "source": {"discovery": "UNKNOWN"}, "title": "NULL-ptr-deref in network sched", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:58:21.572Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1030", "tags": ["x_transferred"]}, {"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1031", "tags": ["x_transferred"]}, {"url": "https://gitee.com/src-openeuler/kernel/pulls/1389", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e8b9bfa110896f95d602d8c98d5f9d67e41d78c", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/3", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/4", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/5", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/9", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/30/10", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/31/3", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/01/31/2", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/02/6", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/02/9", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/03/1", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:openeuler:*:*:*:*:-:*:*:*", "matchCriteriaId": "9550E465-CD37-4936-8E17-0EB0B17E66FC", "versionEndExcluding": "4.19.90-2401.3", "versionStartIncluding": "4.19.90", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C.\n\nThis issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.\n\n"}, {"lang": "es", "value": "La vulnerabilidad de desreferencia de puntero NULL en el kernel openEuler en Linux (m\u00f3dulos de red) permite la manipulaci\u00f3n de puntero. Esta vulnerabilidad est\u00e1 asociada con los archivos de programa net/sched/sch_cbs.C. Este problema afecta al kernel de openEuler: desde 4.19.90 antes de 4.19.90-2401.3."}], "id": "CVE-2021-33630", "lastModified": "2024-06-27T12:15:13.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "securities@openeuler.org", "type": "Secondary"}]}, "published": "2024-01-18T15:15:08.653", "references": [{"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/30/10"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/30/3"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/30/4"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/30/5"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/30/9"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/31/2"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/01/31/3"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/02/02/6"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/02/02/9"}, {"source": "securities@openeuler.org", "url": "http://www.openwall.com/lists/oss-security/2024/02/03/1"}, {"source": "securities@openeuler.org", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e8b9bfa110896f95d602d8c98d5f9d67e41d78c"}, {"source": "securities@openeuler.org", "tags": ["Release Notes"], "url": "https://gitee.com/src-openeuler/kernel/pulls/1389"}, {"source": "securities@openeuler.org", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "securities@openeuler.org", "tags": ["Vendor Advisory"], "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1030"}, {"source": "securities@openeuler.org", "tags": ["Vendor Advisory"], "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1031"}], "sourceIdentifier": "securities@openeuler.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-476"}], "source": "securities@openeuler.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2020:1567", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-193.rt13.51.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-04-28T00:00:00Z"}, {"advisory": "RHSA-2020:1769", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-193.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-04-28T00:00:00Z"}], "bugzilla": {"description": "kernel: net/sched: cbs NULL pointer dereference when offloading is enabled", "id": "2261974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2261974"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-476", "details": ["NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C.\nThis issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.", "A NULL pointer dereference flaw was found in the Linux kernel's network scheduler. This issue occurs when offloading is enabled, the cbs instance is not added to the list. The code also incorrectly handles the case when offload is disabled without removing the qdisc. This could allow a local user to cause a denial of service condition."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2021-33630", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-01-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-33630\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-33630\nhttps://seclists.org/oss-sec/2024/q1/65"], "threat_severity": "Moderate", "upstream_fix": "kernel 5.4-rc1"}