CVE-2021-3420
published 2021-03-05CVE-2021-3420: A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.10%
79.6th percentile
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | newlib | < newlib 3.3.0-1.3+deb12u1 (bookworm) | newlib 3.3.0-1.3+deb12u1 (bookworm) |
| debian | picolibc | < newlib 3.3.0-1.3+deb12u1 (bookworm) | newlib 3.3.0-1.3+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| newlib_project | newlib | < 4.0.0 | 4.0.0 |
| newlib_project | newlib | — | — |
| newlib_project | newlib | >= 0 < 3.3.0-1.3+deb12u1 | 3.3.0-1.3+deb12u1 |
| newlib_project | newlib | >= 0 < 4.4.0.20231231-2 | 4.4.0.20231231-2 |
| newlib_project | newlib | >= 0 < 4.4.0.20231231-2 | 4.4.0.20231231-2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wp32-4vw5-mw9c: A flaw was found in newlib in versions prior to 4
ghsa_unreviewed·2022-05-24
CVE-2021-3420 [CRITICAL] CWE-120 GHSA-wp32-4vw5-mw9c: A flaw was found in newlib in versions prior to 4
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.
OSV
CVE-2021-3420: A flaw was found in newlib in versions prior to 4
osv·2021-03-05·CVSS 9.8
CVE-2021-3420 [CRITICAL] CVE-2021-3420: A flaw was found in newlib in versions prior to 4
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.
CISA ICS
Multiple RTOS (Update E)
cisa_ics·2021-11-30
Multiple RTOS (Update E)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Multiple RTOS (Update E)
Last RevisedApril 19, 2022
Alert CodeICSA-21-119-04
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendors: Multiple
- Equipment: Multiple
- Vulnerabilities: Integer Overflow or Wraparound
CISA is aware of a public report, known as “BadAlloc” that details vulnerabilities found in multiple real-time operating systems (RTOS) and supporting libraries. CISA is issuing this advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and oth
Debian
CVE-2021-3420: newlib - A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validat...
vendor_debian·2021·CVSS 9.8
CVE-2021-3420 [CRITICAL] CVE-2021-3420: newlib - A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validat...
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.
Scope: local
bookworm: resolved (fixed in 3.3.0-1.3+deb12u1)
bullseye: open
forky: resolved (fixed in 4.4.0.20231231-2)
sid: resolved (fixed in 4.4.0.20231231-2)
trixie: resolved (fixed in 4.4.0.20231231-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1934088https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEBF6YHWFNCBW5A2ENSQ3Z56ELF4MTRE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AMK54N6UOPBFFX2YT32TWSAEFTHGSKAA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQZEUANAWBBAOC4TF5PTPJVLMUR7SFD/https://bugzilla.redhat.com/show_bug.cgi?id=1934088https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEBF6YHWFNCBW5A2ENSQ3Z56ELF4MTRE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AMK54N6UOPBFFX2YT32TWSAEFTHGSKAA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQZEUANAWBBAOC4TF5PTPJVLMUR7SFD/
2021-03-05
Published