PT-2021-4073 · Unknown+1 · Libgetdata+1

Pedro Sampaio · Published 2021-01-16 · Updated 2024-10-17 · CVE-2021-20204

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libgetdata version 0.10.0

Description The issue is related to a heap memory corruption problem, specifically a use after free error, that can be triggered when processing maliciously crafted dirfile databases. This may lead to arbitrary code execution or privilege escalation, depending on the input and skills of the attacker, and degrades the confidentiality, integrity, and availability of third-party software that uses libgetdata as a library.

Recommendations For libgetdata version 0.10.0, consider restricting access to maliciously crafted dirfile databases to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using libgetdata to process untrusted databases.

Fix

Buffer Overflow

Use After Free

Weakness Enumeration

CWE-119

CWE-416

Related Identifiers

BDU:2021-04647

CVE-2021-20204

DLA-2660-1

OPENSUSE-SU-2021:1645-1

OPENSUSE-SU-2021_1645-1

Affected Products

Suse

Libgetdata

References · 24

• https://ubuntu.com/security/CVE-2021-20204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20204 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OE23HBLIVKVPOQ5MVADWPOCFMREVF4QZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GB7T7DW7XRPJOUE25ZE7GF244FPCHBWY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43JTGEMYMCTHD3LHFD7ENBNSWCNBCYEY · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2660-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20204 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20204 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1645-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20204 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04647 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20204 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20204 · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/+source/libgetdata/+bug/1912050 · Note
• https://t.me/cvenotify/14372 · Telegram Post