PT-2022-11306 · V2Fly+1 · V2Ray-Core+1

Published 2022-02-23 · Updated 2024-08-21 · CVE-2021-4070

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions v2fly/v2ray-core versions prior to 4.44.0

Description The issue is related to an off-by-one error in indexing operations on arrays, slices, or strings. This error occurs when the index is checked for being less than or equal to the length (<=), instead of less than the length (<), potentially leading to an out-of-bounds index.

Recommendations For versions prior to 4.44.0, update to version 4.44.0 or later to resolve the issue. As a temporary workaround, consider reviewing and adjusting indexing operations to ensure they use an index at most one less than the length.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2021-4070

GHSA-4CXW-HQ44-R344

GO-2022-0550

Affected Products

Debian

V2Ray-Core

References · 14

• 🔥 https://huntr.dev/bounties/8da19456-4d89-41ef-9781-a41efd6a1877 · Exploit
• https://github.com/v2fly/v2ray-core/commit/c1af2bfd7aa59a4482aa7f6ec4b9208c1d350b5c · Patch
• https://ubuntu.com/security/CVE-2021-4070 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4070 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4070 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-4070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4070 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4070 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4070 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0550 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4cxw-hq44-r344 · Vendor Advisory
• https://github.com/v2fly/v2ray-core · Note
• https://t.me/cibsecurity/37964 · Telegram Post
• https://github.com/advisories/GHSA-4cxw-hq44-r344 · Note