CVE-2021-31873

An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
VendorProductVersion
klibc_projectklibc
𝑥
< 2.0.9
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
klibc
bullseye
2.0.8-6.1
fixed
bookworm
2.0.12-1
fixed
sid
2.0.13-4
fixed
trixie
2.0.13-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
klibc
jammy
not-affected
impish
not-affected
hirsute
ignored
groovy
ignored
focal
Fixed 2.0.7-1ubuntu5.1
released
bionic
Fixed 2.0.4-9ubuntu2.1
released
xenial
Fixed 2.0.4-8ubuntu1.16.04.4+esm1
released
trusty
Fixed 2.0.3-0ubuntu1.14.04.3+esm2
released
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2021/04/30/1
https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=a31ae8c508fc8d1bca4f57e9f9f88127572d5202
https://github.com/huolinjue/klibc/commit/a31ae8c508fc8d1bca4f57e9f9f88127572d5202
https://kernel.org/pub/linux/libs/klibc/2.0/
https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html
https://lists.zytor.com/archives/klibc/2021-April/004593.html
http://www.openwall.com/lists/oss-security/2021/04/30/1
https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=a31ae8c508fc8d1bca4f57e9f9f88127572d5202
https://github.com/huolinjue/klibc/commit/a31ae8c508fc8d1bca4f57e9f9f88127572d5202
https://kernel.org/pub/linux/libs/klibc/2.0/
https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html
https://lists.zytor.com/archives/klibc/2021-April/004593.html