CVE-2021-42341

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-42341
checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://bugs.gentoo.org/816900 Exploit Patch Third Party Advisory
https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae Patch Third Party Advisory
https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204 Patch Third Party Advisory
https://github.com/OpenRC/openrc/issues/418 Exploit Patch Third Party Advisory
https://github.com/OpenRC/openrc/issues/459 Exploit Patch Third Party Advisory
https://github.com/OpenRC/openrc/pull/462 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openrc_project:openrc:*:*:*:*:*:*:*:*
History

20 Oct 2021, 19:03

Type Values Removed Values Added
CPE cpe:2.3:a:openrc_project:openrc:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 7.5
CWE NVD-CWE-Other
References (MISC) https://bugs.gentoo.org/816900 - (MISC) https://bugs.gentoo.org/816900 - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae - (MISC) https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae - Patch, Third Party Advisory
References (MISC) https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204 - (MISC) https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204 - Patch, Third Party Advisory
References (MISC) https://github.com/OpenRC/openrc/issues/418 - (MISC) https://github.com/OpenRC/openrc/issues/418 - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/OpenRC/openrc/issues/459 - (MISC) https://github.com/OpenRC/openrc/issues/459 - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/OpenRC/openrc/pull/462 - (MISC) https://github.com/OpenRC/openrc/pull/462 - Patch, Third Party Advisory

14 Oct 2021, 17:15

Type Values Removed Values Added
Summary checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
References
  • (MISC) https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae -
  • (MISC) https://github.com/OpenRC/openrc/issues/418 -

14 Oct 2021, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-10-14 05:15

Updated : 2024-02-04 22:08

NVD link : CVE-2021-42341

Mitre link : CVE-2021-42341

CVE.ORG link : CVE-2021-42341

JSON object : View

Products Affected

openrc_project

  • openrc
CWE
NVD-CWE-Other