PT-2021-4457 · Gnu+10 · Gnu Cpio+10
Maverick Chung
·
Published
2021-08-07
·
Updated
2025-06-09
·
CVE-2021-38185
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNU cpio versions 2.13 and earlier
Description
The issue is caused by an integer overflow in the dstring.c component of the GNU cpio package, specifically in the
ds fgetstr function. This overflow triggers an out-of-bounds heap write, allowing attackers to execute arbitrary code via a crafted pattern file associated with the -E option. It is unclear whether there are common cases where the pattern file is untrusted data.Recommendations
For GNU cpio versions 2.13 and earlier, consider disabling the use of crafted pattern files with the -E option until a patch is available. As a temporary workaround, restrict the use of the
ds fgetstr function in the dstring.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Gnu Cpio
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu