CVE-2021-36222 Null dereference in n/a
Remote attackers can crash the MIT Kerberos KDC daemon via a NULL pointer dereference in the pre-authentication verification process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36222?
CVE-2021-36222 is a high-severity vulnerability in Debian Debian Linux, published on 22 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
Weakness: CWE-476
Which versions are affected by CVE-2021-36222?
It affects 7 products.
Linux distribution packages (18)
krb5 SUSE:Enterprise Storage 6 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Micro 5.0 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Manager Proxy 4.0 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Manager Retail Branch Server 4.0 | All versions | 1.16.3-3.21.1 |
krb5 SUSE:Manager Server 4.0 | All versions | 1.16.3-3.21.1 |
krb5 openSUSE:Leap 15.2 | All versions | 1.16.3-lp152.5.19.1 |
krb5-mini openSUSE:Leap 15.2 | All versions | 1.16.3-lp152.5.19.1 |
krb5 openSUSE:Leap 15.3 | All versions | 1.16.3-3.21.1 |
krb5-mini openSUSE:Leap 15.3 | All versions | 1.16.3-3.21.1 |
Products include Debian Debian Linux, Mit Kerberos 5, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Netapp Snapcenter and 1 more.
How do I fix CVE-2021-36222?
Upgrade to a fixed version.
Is CVE-2021-36222 being exploited?
There is no known exploitation of CVE-2021-36222 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-36222, AZL-6607, CLEANSTART-2024-BR37030, DEBIAN-CVE-2021-36222, DSA-4944-1, GHSA-7gwg-3h62-pwf5 and 5 more.