PT-2021-22788 · Huawei · Cloudengine 7800+4

Published 2021-12-08 · Updated 2021-12-15 · CVE-2021-40008

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CloudEngine 12800 version V200R019C00SPC800 CloudEngine 5800 version V200R019C00SPC800 CloudEngine 6800 version V200R019C00SPC800 CloudEngine 7800 version V200R019C00SPC800

Description The software does not sufficiently track and release allocated memory while parsing a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust.

Recommendations For CloudEngine 12800 version V200R019C00SPC800, update to a version that includes the fix for the memory leak issue. For CloudEngine 5800 version V200R019C00SPC800, update to a version that includes the fix for the memory leak issue. For CloudEngine 6800 version V200R019C00SPC800, update to a version that includes the fix for the memory leak issue. For CloudEngine 7800 version V200R019C00SPC800, update to a version that includes the fix for the memory leak issue. As a temporary workaround, consider restricting the parsing of crafted binary messages to minimize the risk of exploitation.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2021-40008

Affected Products

Cloudengine 12800

Cloudengine 5800

Cloudengine 6800

Cloudengine 7800

Huawei Vrp

References · 4

• https://osv.dev/vulnerability/CVE-2021-40008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40008 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20211208-01-memleak-en · Vendor Advisory
• https://t.me/cibsecurity/33845 · Telegram Post