CVE Feed

    Dashboard / CVE / CVE-2021-37847

    CVE-2021-37847

    crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.

    Published:Aug 2, 2021
    Last Modified:Nov 21, 2024
    EPS:Aug 2, 2021
    EPSS Score:0.00316
    CVSS Score:7.5

    Affected Products

    Vendor
    Pengutronix
    Product
    Barebox

    Exploits

    https://gist.github.com/gquere/816dfadbad98745090034100a8a651ebhttps://gist.github.com/gquere/816dfadbad98745090034100a8a651eb

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-34963 (CVSS 8.6) — barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi…
    CVE-2026-34962 (CVSS 6.9) — barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/…
    CVE-2026-34961 (CVSS 6.9) — barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to m…
    CVE-2026-34960 (CVSS 7.1) — barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within …
    CVE-2026-33243 (CVSS 8.2) — barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding …
    CVE-2024-57262 (CVSS 7.1) — In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 var…
    CVE-2024-57261 (CVSS 7.1) — In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE…
    CVE-2021-37848 (CVSS 7.5) — common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used du…
    CVE-2020-13910 (CVSS 9.1) — Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a fiel…
    CVE-2019-15937 (CVSS 9.8) — Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High