CVE-2021-42574
published 2021-11-01CVE-2021-42574: An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control…
PriorityP353high8.3CVSS 3.1
AVNACHPRNUIRSCCHIHAH
EPSS
12.21%
95.7th percentile
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rustc | < rustc 1.57.0+dfsg1-1 (bookworm) | rustc 1.57.0+dfsg1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| starwindsoftware | starwind_virtual_san | — | — |
| unicode | unicode | < 14.0.0 | 14.0.0 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
osv8.3HIGH
vendor_debian8.3LOW
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
vendor_redhat·2021-11-01·CVSS 8.3
CVE-2021-42574 [HIGH] CWE-838 environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standa
Debian
CVE-2021-42574: rustc - An issue was discovered in the Bidirectional Algorithm in the Unicode Specificat...
vendor_debian·2021·CVSS 8.3
CVE-2021-42574 [HIGH] CVE-2021-42574: rustc - An issue was discovered in the Bidirectional Algorithm in the Unicode Specificat...
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text
OSV
CVE-2021-42574: An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14
osv·2021-11-01·CVSS 8.3
CVE-2021-42574 [HIGH] CVE-2021-42574: An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text
No detection rules found.
No public exploits indexed.
Krebs
‘Trojan Source’ Bug Threatens the Security of All Code
blogs_krebs·2021-11-01
‘Trojan Source’ Bug Threatens the Security of All Code
Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability disclosure was coordinated with multiple organizations, some of whom are now releasing updates to address the security weakness.
Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode , which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters acro
Krebs
‘Trojan Source’ Bug Threatens the Security of All Code
blogs_krebs·2021-11-01
‘Trojan Source’ Bug Threatens the Security of All Code
Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability disclosure was coordinated with multiple organizations, some of whom are now releasing updates to address the security weakness.
Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters acros
Schneier
Hiding Vulnerabilities in Source Code - Schneier on Security
blogs_schneier·2021-11-01·CVSS 8.3
[HIGH] Hiding Vulnerabilities in Source Code - Schneier on Security
## Hiding Vulnerabilities in Source Code
Really interesting research demonstrating how to hide vulnerabilities in source code by manipulating how Unicode text is displayed. It’s really clever, and not the sort of attack one would normally think about.
From Ross Anderson’s blog :
We have discovered ways of manipulating the encoding of source code files so that human viewers and compilers see different logic. One particularly pernicious method uses Unicode directionality override characters to display code as an anagram of its true logic. We’ve verified that this attack works against C, C++, C#, JavaScript, Java, Rust, Go, and Python, and suspect that it will work against most other modern languages.
This potentially devastating attack is tracked as CVE-2021-42574, while a related attack
arXiv
Trojan Source: Invisible Vulnerabilities
arxiv_fulltext·2023-03-08
Trojan Source: Invisible Vulnerabilities
T2A х
T2A Н
basicstyle=
Trojan Source:
Invisible Vulnerabilities
Nicholas Boucher
University of Cambridge
Computer Science & Technology
[email protected]
Ross Anderson
University of Cambridge
and University of Edinburgh
[email protected]
firststyle
## Abstract
We present a new type of attack in which source code is maliciously encoded so that it appears different to a compiler and to the human eye. This attack exploits subtleties in text-encoding standards such as Unicode to produce source code whose tokens are logically encoded in a different order from the one in which they are displayed, leading to vulnerabilities that cannot be perceived directly by human code reviewers. `Trojan Source' attacks, as we call them, pose an immediate threat both to first-pa
arXiv
Talking Trojan: Analyzing an Industry-Wide Disclosure
arxiv_fulltext·2022-09-22
Talking Trojan: Analyzing an Industry-Wide Disclosure
## Abstract
While vulnerability research often focuses on technical findings and post-public release industrial response, we provide an analysis of the rest of the story: the coordinated disclosure process from discovery through public release. The industry-wide `Trojan Source' vulnerability which affected most compilers, interpreters, code editors, and code repositories provided an interesting natural experiment, enabling us to compare responses by firms versus nonprofits and by firms that managed their own response versus firms that outsourced it. We document the interaction with bug bounty programs, government disclosure assistance, academic peer review, and press coverage, among other topics. We compare the response to an attack on source code with the response to a comparable attack
http://www.openwall.com/lists/oss-security/2021/11/01/1http://www.openwall.com/lists/oss-security/2021/11/01/4http://www.openwall.com/lists/oss-security/2021/11/01/5http://www.openwall.com/lists/oss-security/2021/11/01/6http://www.openwall.com/lists/oss-security/2021/11/02/10http://www.unicode.org/versions/Unicode14.0.0/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2RG5YTR6ZZOLUV3EUPZEIJR7XHJLVD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQNTFF24ROHLVPLUOEISBN3F7QM27L4U/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUPA37D57VPTDLSXOOGF4UXUEADOC4PQ/https://security.gentoo.org/glsa/202210-09https://trojansource.codeshttps://www.kb.cert.org/vuls/id/999008https://www.scyon.nl/post/trojans-in-your-source-codehttps://www.starwindsoftware.com/security/sw-20220804-0002/https://www.unicode.org/reports/tr31/https://www.unicode.org/reports/tr36/https://www.unicode.org/reports/tr39/https://www.unicode.org/reports/tr9/tr9-44.html#HL4http://www.openwall.com/lists/oss-security/2021/11/01/1http://www.openwall.com/lists/oss-security/2021/11/01/4http://www.openwall.com/lists/oss-security/2021/11/01/5http://www.openwall.com/lists/oss-security/2021/11/01/6http://www.openwall.com/lists/oss-security/2021/11/02/10http://www.unicode.org/versions/Unicode14.0.0/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2RG5YTR6ZZOLUV3EUPZEIJR7XHJLVD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQNTFF24ROHLVPLUOEISBN3F7QM27L4U/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUPA37D57VPTDLSXOOGF4UXUEADOC4PQ/https://security.gentoo.org/glsa/202210-09https://trojansource.codeshttps://www.kb.cert.org/vuls/id/999008https://www.scyon.nl/post/trojans-in-your-source-codehttps://www.starwindsoftware.com/security/sw-20220804-0002/https://www.unicode.org/reports/tr31/https://www.unicode.org/reports/tr36/https://www.unicode.org/reports/tr39/https://www.unicode.org/reports/tr9/tr9-44.html#HL4
2021-11-01
Published