Vulnerability Details : CVE-2021-33910
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
Exploit prediction scoring system (EPSS) score for CVE-2021-33910
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 8 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-33910
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
[email protected] |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
[email protected] |
CWE ids for CVE-2021-33910
-
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Assigned by: [email protected] (Primary)
References for CVE-2021-33910
-
https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
Patch;Third Party Advisory
-
https://www.debian.org/security/2021/dsa-4942
Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/[email protected]/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/
Mailing List;Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
-
https://github.com/systemd/systemd-stable/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b
Patch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/[email protected]/message/2LSDMHAKI4LGFOCSPXNVVSEWQFAVFWR7/
Mailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2021/08/17/3
Mailing List;Patch;Third Party Advisory
-
https://github.com/systemd/systemd-stable/commit/cfd14c65374027b34dbbc4f0551456c5dc2d1f61
Patch;Third Party Advisory
-
https://github.com/systemd/systemd-stable/commit/b00674347337b7531c92fdb65590ab253bb57538
Patch;Third Party Advisory
-
https://github.com/systemd/systemd/commit/b34a4f0e6729de292cb3b0c03c1d48f246ad896b
Patch;Third Party Advisory
-
https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce
Patch;Third Party Advisory
-
http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html
Exploit;Third Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2021/09/07/3
Mailing List;Patch;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2021/08/04/2
Mailing List;Patch;Third Party Advisory
-
https://security.gentoo.org/glsa/202107-48
Third Party Advisory
-
https://www.openwall.com/lists/oss-security/2021/07/20/2
Exploit;Mailing List;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20211104-0008/
Third Party Advisory
Products affected by CVE-2021-33910
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*