PT-2021-4108 · Upx+2 · Upx+2

Chibataiki · Published 2020-10-02 · Updated 2023-04-11 · CVE-2021-30500

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UPX version 4.0.0

Description A null pointer dereference was found in the PackLinuxElf::canUnpack() function in p lx elf.cpp, which can allow attackers to execute arbitrary code and cause a denial of service via a crafted file. This issue may also enable remote attackers to access confidential data, compromise its integrity, and disrupt service.

Recommendations For UPX version 4.0.0, consider disabling the PackLinuxElf::canUnpack() function until a patch is available to prevent potential exploitation. Restrict access to crafted files that could trigger the null pointer dereference to minimize the risk of denial of service or arbitrary code execution.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2020-2930

BDU:2021-04695

CVE-2021-30500

OPENSUSE-SU-2023:0088-1

Affected Products

Alt Linux

Debian

Upx

References · 39

• 🔥 https://github.com/upx/upx/issues/485 · Exploit
• https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30500 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30500 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04695 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-30500 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30500 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-30500 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2023:0088-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30500 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30500 · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-43317 · Note
• https://bugzilla.suse.com/1209770 · Note
• https://suse.com/security/cve/CVE-2023-23456 · Note
• https://suse.com/security/cve/CVE-2021-43314 · Note