PT-2021-6552 · Faad2+4 · Faad2+4

Seviezhou · Published 2021-09-20 · Updated 2023-08-29 · CVE-2021-32276

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions faad2 versions through 2.10.0

Description An issue exists in the function get sample() located in output.c, which allows an attacker to cause Denial of Service due to a NULL pointer dereference. This can be exploited by a remote attacker to disrupt service.

Recommendations For versions through 2.10.0, as a temporary workaround, consider disabling the get sample() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2023-1533

ALT-PU-2023-1579

BDU:2022-01813

CVE-2021-32276

DLA-2792-1

DSA-5109-1

USN-6313-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Ubuntu

Faad2

References · 27

• 🔥 https://github.com/knik0/faad2/issues/58 · Exploit
• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/faad/global-buffer-overflow%40ps_mix_phase.md · Exploit
• 🔥 https://github.com/TeamSeri0us/pocs/tree/master/faad · Exploit
• https://ubuntu.com/security/CVE-2023-38858 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32276 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32276 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32273 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32272 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32278 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32276 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2792-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6313-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5109 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01813 · Security Note