CVE-2021-42574 — Code Injection in Unicode

CWE-94 — Code InjectionCWE-838 — Inappropriate Encoding for Output Context6 documents6 sources
Severity
8.3HIGHNVD
EPSS
25.0%
top 3.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
UnicodeFedoraproject FedoraStarwindsoftware Starwind Virtual SAN
Timeline
PublishedNov 1

Description

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consor…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.6 | Impact: 6.0

Affected Packages2 packages

▶NVDunicode/unicode< 14.0.0

Also affects: Fedora 33, 34, 35

🔴Vulnerability Details

2
CVEList
CVE-2021-42574: An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14↗2021-11-01
▶
OSV
CVE-2021-42574: An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14↗2021-11-01
▶

📋Vendor Advisories

2
Red Hat
environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks↗2021-11-01
▶
Debian
CVE-2021-42574: rustc - An issue was discovered in the Bidirectional Algorithm in the Unicode Specificat...↗2021
▶

🕵️Threat Intelligence

1
Schneier
Hiding Vulnerabilities in Source Code - Schneier on Security↗2021-11-01
▶
CVE-2021-42574 — Code Injection in Unicode | cvebase