Ubuntu.comUB:CVE-2021-42341CVE-2021-42341
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.01 Low
EPSS
Percentile
83.8%
checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to
allocate strings, which does not account for the ‘\0’ byte at the end of
the string. This results in memory corruption. CVE-2021-42341 was
introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which
was introduced as part of OpenRC 0.44.0 development.
References
bugs.gentoo.org/816900
github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae
github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204
github.com/OpenRC/openrc/issues/418
github.com/OpenRC/openrc/issues/459
github.com/OpenRC/openrc/pull/462
launchpad.net/bugs/cve/CVE-2021-42341
nvd.nist.gov/vuln/detail/CVE-2021-42341
security-tracker.debian.org/tracker/CVE-2021-42341
www.cve.org/CVERecord?id=CVE-2021-42341
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.01 Low
EPSS
Percentile
83.8%