The Linux kernel before 5.11.14 has a use-after-free in cipsov4genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"313550559384622054362200531636951884629",
"110685730424993798233307433431095796351",
"21107814097289457216597164079676228438",
"101930984018779448872795875451658176428",
"47585686352983300635970392373653509021",
"200136452352172135757928750201370940935",
"318511240919553467434536411329651005779",
"227435939254509907832008654035269589295",
"214577477835587771598330314660773006618",
"311719202423076463138026101342312592431",
"140139319709883149710137652108888946738",
"129260817399963375707766954548645465866",
"248857359162050059336232407169812042372",
"122025020250626281308959293121795281583",
"203927861435021037949098600345407471380",
"128253802630038956640912572446348964887",
"89770978328646865607295482915840934279",
"162557312918901137919761482363572890941",
"87094079822245540707912198801814983704",
"84673066851241970246837449259944026296"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-08861844",
"signature_type": "Line",
"target": {
"file": "net/ipv6/calipso.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169075460786027121162818410784760078134",
"326338649288269709909304421170679448488",
"136903552922240812224056422373948603995",
"331612020406811836343360553329904902305",
"15870592715131896257627874819959901230",
"35615825900787777367539776395745170622",
"85526310610280598975061741900745808197",
"296858888498432587170990409763337727786",
"246341385838856505703361522716901072727",
"288033185965936677110906663881667119661",
"326196988994476482137359286778553990276",
"133125408088952745126697624733432998088",
"324936292247677811280235263049625139919",
"44936474823658860406798308266929127206"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-52b45f32",
"signature_type": "Line",
"target": {
"file": "net/netlabel/netlabel_cipso_v4.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 705.0,
"function_hash": "308233021096637275632373894946877335998"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-69bb5937",
"signature_type": "Function",
"target": {
"function": "calipso_doi_remove",
"file": "net/ipv6/calipso.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 716.0,
"function_hash": "189134941885147917881815604313900558469"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-7032eca9",
"signature_type": "Function",
"target": {
"function": "cipso_v4_doi_remove",
"file": "net/ipv4/cipso_ipv4.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 280.0,
"function_hash": "117921117647412114701090067116194951618"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-b4ff7679",
"signature_type": "Function",
"target": {
"function": "calipso_doi_putdef",
"file": "net/ipv6/calipso.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"101930984018779448872795875451658176428",
"188659505538518640884715933882999966523",
"252198680934677017945129044610032388516",
"201866154822532917864230754963401475833",
"284831185041441574280690411687358818761",
"214577477835587771598330314660773006618",
"250778050567157794908055013419725814263",
"182497265171733808584479056108094309763",
"18850567686963362110868415316823337955",
"154812459697631845153856749839144406691",
"59307442577211820727464264213026850846",
"112308026081559188370467062776987542550",
"139174238206150384066193027839494706571",
"160496531764407857562883233580347095834",
"158559624426788468674629438723923159001",
"312227044077852559710444666270275182330",
"18850567686963362110868415316823337955",
"35632843962111925898699565654848623438"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-cf14efce",
"signature_type": "Line",
"target": {
"file": "net/ipv4/cipso_ipv4.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 2773.0,
"function_hash": "278219272230026651908138565645905215799"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-d0f60957",
"signature_type": "Function",
"target": {
"function": "netlbl_cipsov4_list",
"file": "net/netlabel/netlabel_cipso_v4.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"141046790235034296000654808624326309598",
"17858716093509962181476214737574841052",
"155499642865708632314640502126039000129",
"48449906918959477256061121678710295639"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@1165affd484889d4986cf3b724318935a0b120d8",
"deprecated": false,
"id": "CVE-2021-33033-f90633cb",
"signature_type": "Line",
"target": {
"file": "net/mac802154/llsec.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 291.0,
"function_hash": "331539525170788999005999512848097489486"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ad5d07f4a9cd671233ae20983848874731102c08",
"deprecated": false,
"id": "CVE-2021-33033-fe43b4f9",
"signature_type": "Function",
"target": {
"function": "cipso_v4_doi_putdef",
"file": "net/ipv4/cipso_ipv4.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33033.json"