High
Security advisory
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-37848
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:27 UTC · Revision 1
Source evidence
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.
osv:CVE-2021-37848
Complete source record
{
"id": "2af86211bdf17bd2703e54ac641845789cfe0cb7ce5b4f5b79652508bd9090f6",
"url": "https://osv.dev/vulnerability/CVE-2021-37848",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-37848",
"summary": "common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.",
"evidence": "osv:CVE-2021-37848",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-37848",
"aliases": [
"CVE-2021-37848"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/barebox/barebox",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "72424fd057d135ec0e41139fe4cb5740471d33a5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2021.07.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2021.07.0",
"v2021.06.0",
"v2021.05.0",
"v2021.03.0",
"v2021.02.0",
"v2021.01.0",
"v2020.12.0",
"v2020.11.0",
"v2020.10.0",
"v2020.09.0",
"v2020.08.0",
"v2020.07.0",
"v2020.06.0",
"v2020.05.0",
"v2020.04.0",
"v2020.03.0",
"v2020.02.0",
"v2020.01.0",
"v2019.12.0",
"v2019.11.0",
"v2019.10.0",
"v2019.09.0",
"v2019.08.0",
"v2019.07.0",
"v2019.06.0",
"v2019.05.0",
"v2019.04.0",
"v2019.03.0",
"v2019.02.0",
"v2019.01.0",
"v2018.12.0",
"v2018.11.0",
"v2018.10.0",
"v2018.09.0",
"v2018.08.0",
"v2018.07.0",
"v2018.06.0",
"v2018.05.0",
"v2018.04.0",
"v2018.03.0",
"v2018.02.0",
"v2018.01.0",
"v2017.12.0",
"v2017.11.0",
"v2017.10.0",
"v2017.09.0",
"v2017.08.0",
"v2017.07.0",
"v2017.06.0",
"v2017.05.0",
"v2017.04.0",
"v2017.03.0",
"v2017.02.0",
"v2017.01.0",
"v2016.11.0",
"v2016.10.0",
"v2016.08.0",
"v2016.09.0",
"v2016.07.0",
"v2016.06.0",
"v2016.05.0",
"v2016.04.0",
"v2016.03.0",
"v2016.02.0",
"v2016.01.0",
"v2015.12.0",
"v2015.11.0",
"v2015.10.0",
"v2015.09.0",
"v2015.08.0",
"v2015.07.0",
"v2015.06.0",
"v2015.05.0",
"v2015.04.0",
"v2015.03.0",
"v2015.02.0",
"v2015.01.0",
"v2014.12.0",
"v2014.11.0",
"v2014.10.0",
"v2014.09.0",
"v2014.08.0",
"v2014.07.0",
"v2014.06.0",
"v2014.05.0",
"v2014.04.0",
"v2014.03.0",
"v2014.02.0",
"v2014.01.0",
"v2013.12.0",
"v2013.11.0",
"v2013.10.0",
"v2013.09.0",
"v2013.08.0",
"v2013.07.0",
"v2013.06.0",
"v2013.05.0",
"v2013.04.0",
"v2013.03.0",
"v2013.02.0",
"v2013.01.0",
"v2012.12.0",
"v2012.11.0",
"v2012.10.0",
"v2012.09.0",
"v2012.08.0",
"v2012.07.0",
"v2012.06.0",
"v2012.05.0",
"v2012.04.0",
"v2012.03.0",
"v2012.02.0",
"v2012.01.0",
"v2011.12.0",
"v2011.11.0",
"v2011.10.0",
"v2011.09.0",
"v2011.08.0",
"v2011.07.0",
"v2011.06.0",
"v2011.05.0",
"v2011.04.0",
"v2011.03.0",
"v2011.02.0",
"v2011.01.0",
"v2010.12.0",
"v2010.11.0",
"v2010.10.0",
"v2010.09.0",
"v2010.08.0",
"v2010.07.0",
"v2010.06.0",
"v2010.05.0",
"v2010.04.0",
"v2010.03.0",
"v2010.02.0",
"v2009.12.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37848.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/saschahauer/barebox",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a3337563c705bc8e0cf32f910b3e9e3c43d962ff"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "a3337563c705bc8e0cf32f910b3e9e3c43d962ff"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37848.json",
"vanir_signatures": [
{
"id": "CVE-2021-37848-00cbff65",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286483416564148237014664334187897996842",
"82341561494851006650848126628061910030",
"160300210200201742434445603001761179386",
"331255837984390417579900180276178061273",
"71206244788899728916889356691555085839",
"256458294048974650112929662464190582585",
"333251219697399135318302262459666338848",
"183776022809160989712221249666787241014",
"254544937353092481425502287652833645885",
"77921965859436756916281033906327323109",
"230797779611143726437514116441912154259",
"32386485479158884066927671304407540509"
]
},
"source": "https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff",
"target": {
"file": "common/password.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-37848-63c8d193",
"digest": {
"length": 1171,
"function_hash": "90977046801678930462450758757847571578"
},
"source": "https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff",
"target": {
"file": "common/password.c",
"function": "check_passwd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:31:37Z"
}
}
],
"modified": "2026-10-24T14:31:37.232206801Z",
"provider": "osv",
"references": [
"https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff",
"https://gist.github.com/gquere/816dfadbad98745090034100a8a651eb"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-37848",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443763,
"published_at": "2021-08-02T20:15:08.303+00:00"
}