Vulnerability Details : CVE-2021-31872
An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buffer overflow or other security impact.
Vulnerability category: Overflow
Products affected by CVE-2021-31872
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:klibc_project:klibc:*:*:*:*:*:x86:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-31872
0.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-31872
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2021-31872
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-31872
-
http://www.openwall.com/lists/oss-security/2021/04/30/1
oss-security - [ANNOUNCE] klibc 2.0.9Mailing List;Release Notes;Third Party Advisory
-
https://kernel.org/pub/linux/libs/klibc/2.0/
Index of /pub/linux/libs/klibc/2.0/Release Notes;Third Party Advisory
-
https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=9b1c91577aef7f2e72c3aa11a27749160bd278ff
klibc/klibc.git - klibc main development treePatch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html
[SECURITY] [DLA 2695-1] klibc security updateThird Party Advisory
-
https://lists.zytor.com/archives/klibc/2021-April/004593.html
[klibc] [ANNOUNCE] klibc 2.0.9Mailing List;Release Notes;Third Party Advisory
Jump to