PT-2021-4323 · Newlib+1 · Newlib+1

Guilherme De Almeida Suckevicz · Published 2021-03-05 · Updated 2024-06-15 · CVE-2021-3420

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions newlib versions prior to 4.0.0

Description A flaw was found in newlib due to improper overflow validation in memory allocation functions, such as mEMALIGn, pvALLOc, nano memalign, nano valloc, and nano pvalloc. This could cause an integer overflow, leading to the allocation of a small buffer and then to a heap-based buffer overflow. The issue is related to a whole number overflow, which can be exploited by a remote attacker to cause a buffer overflow.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable memory allocation functions until a patch is available.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2021-04947

CVE-2021-3420

OPENSUSE-SU-2024:11086-1

Affected Products

Debian

Newlib

References · 20

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQZEUANAWBBAOC4TF5PTPJVLMUR7SFD · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11086-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1934088 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AEBF6YHWFNCBW5A2ENSQ3Z56ELF4MTRE · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3420 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LSQZEUANAWBBAOC4TF5PTPJVLMUR7SFD · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3420 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04947 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3420 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3420 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3420 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AMK54N6UOPBFFX2YT32TWSAEFTHGSKAA · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3420 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEBF6YHWFNCBW5A2ENSQ3Z56ELF4MTRE · Vendor Advisory