Low severity · published May 7, 2024
CVE-2021-35000
OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.
. Was ZDI-CAN-16112.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · OpenBSD
OpenBSD 6.9 · source: vendor
OP
Openbsd · Openbsd
6.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35000
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-012/
More from Kernel
5.5
CVE-2021-34999
OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability
