PT-2021-7818 · Xmill · Xmill

Carl Hurd · Published 2021-08-10 · Updated 2022-10-06 · CVE-2021-21814

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xmill (affected versions not specified)

Description The issue is related to the function HandleFileArg in the Xmill XML compression tool, which is vulnerable to exploitation due to the lack of checks on user-provided input. Specifically, the filepattern argument is passed directly to strlen to determine the ending location of the user-provided char*, and then memcpy is used to copy data into a statically sized buffer without checking if the input is longer than the buffer. After the memcpy, a null byte is written to what is assumed to be the end of the buffer to terminate the char*, but without length checks, this null write can occur at an arbitrary offset from the buffer. An attacker can provide malicious input to trigger this vulnerability, potentially allowing a local attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2023-03272

CVE-2021-21814

Affected Products

Xmill

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1280 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21814 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21814 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20210813.1.pdf · Security Note
• https://bdu.fstec.ru/vul/2023-03272 · Security Note
• https://t.me/cvenotify/19940 · Telegram Post
• https://se.com/ww/en/download/document/SEVD-2021-222-02 · Note
• https://vuldb.com/?id.180878 · Note