LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33033: The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because th...

The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-safety flaw in CIPSO/CALIPSO networking label handling. A bug in reference counting can cause use-after-free behavior and arbitrary value writing. The sources identify Linux kernels before 5.11.14, but do not provide CVSS, affected distribution mapping, or evidence of active exploitation.

Executive priority

Treat this as a kernel patching priority for affected Linux fleets, not as confirmed active exploitation. Business urgency rises for multi-tenant, exposed, or policy-labeled networking environments.

Technical view

CVE-2021-33033 is a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c. The CVE description attributes it to mishandled CIPSO and CALIPSO DOI definition refcounting, fixed by upstream kernel commits including ad5d07f4a9cd and reflected in 5.11.14 sources.

Likely exposure

Exposure is most likely on Linux systems running kernels before 5.11.14, especially where CIPSO, CALIPSO, or NetLabel-related paths are present. Distribution backports may change exposure, so upstream version alone is not definitive.

Exploitation context

The bundle cites syzkaller and SyzScope crash analysis, indicating automated discovery and reproducible kernel memory-safety behavior. It does not cite CISA KEV, in-the-wild exploitation, public weaponization, or a complete exploit chain.

Researcher notes

The strongest evidence is upstream kernel metadata and syzkaller/SyzScope analysis. Missing evidence includes CVSS scoring, distribution-specific affected package lists, exploit prerequisites, and confirmed attacker use.

Mitigation direction

  • Upgrade to Linux 5.11.14 or a vendor kernel containing the upstream fixes.
  • Check distribution advisories for backported fixes to supported kernel packages.
  • Prioritize hosts using labeled networking, CIPSO, CALIPSO, or NetLabel features.
  • If patch timing is constrained, follow vendor guidance for temporary exposure reduction.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and container hosts.
  • Confirm whether vendor kernels include commits ad5d07f4a9cd or 1165affd equivalents.
  • Review whether CIPSO, CALIPSO, or NetLabel functionality is used in the environment.
  • Track kernel crash reports for related cipso_v4_genopt or KASAN indicators.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-33033 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.