CVE-2021-32471

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbitrary code via crafted data. For example, a tape head may have an unexpected location after the processing of input composed of As and Bs (instead of 0s and 1s). NOTE: the discoverer states "this vulnerability has no real-world implications."

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://arxiv.org/abs/2105.02124Third Party Advisory
https://github.com/intrinsic-propensity/turing-machineExploit, Third Party Advisory
https://arxiv.org/abs/2105.02124Third Party Advisory
https://github.com/intrinsic-propensity/turing-machineExploit, Third Party Advisory

Timeline

Published: May 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-324724.3Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.CVE-2021-324735.3It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to CVE-2021-324747.2An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this re CVE-2021-324755.4ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3 CVE-2021-324767.5A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3 CVE-2021-324774.3The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capabil CVE-2021-324786.1The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versio CVE-2021-324816.1Cloudera Hue 4.6.0 allows XSS via the type parameter.CVE-2021-324826.1Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.CVE-2021-324835.3Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.CVE-2021-324847.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additio CVE-2021-324857.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additio