CVE-2021-33910

CWE-770 — Allocation without LimitsCWE-400 — Uncontrolled Resource Consumption13 documents9 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 86.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Systemd Project SystemdDebian Debian LinuxFedoraproject Fedora
Timeline
PublishedJul 20
Latest updateMay 24

Description

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDsystemd_project/systemd247 — 247.8+3
▶Debiansystemd< 247.3-6+3
▶Ubuntusystemd< 237-3ubuntu10.49+2

Also affects: Debian Linux 10.0, Fedora 33, 34

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-5337-wcgc-wcvp: basic/unit-name↗2022-05-24
▶
OSV
systemd vulnerabilities↗2021-07-20
▶
OSV
systemd vulnerabilities↗2021-07-20
▶
CVEList
CVE-2021-33910: basic/unit-name↗2021-07-20
▶
OSV
CVE-2021-33910: basic/unit-name↗2021-07-20
▶

📋Vendor Advisories

5
Ubuntu
systemd vulnerabilities↗2021-07-20
▶
Red Hat
systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash↗2021-07-20
▶
Ubuntu
systemd vulnerabilities↗2021-07-20
▶
Microsoft
basic/unit-name.c in systemd prior to 246.15 247.8 248.5 and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) tha↗2021-07-13
▶
Debian
CVE-2021-33910: systemd - basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memo...↗2021
▶

🕵️Threat Intelligence

1
Qualys
CVE-2021-33910: Denial of Service (Stack Exhaustion) in systemd (PID 1) | Qualys↗2021-07-20
▶