CVE-2021-33910: Medium severity ibm cloud pak for security vulnerability
A flaw was found in systemd. Attacker controlled alloca() in function unitnamepathescape() leads to a crash in systemd and ultimately a kernel panic. Systemd parses the content of /proc/self/mountinfo and each mountpoint is passed to mountsetupunit(), which calls unitnamepathescape() underneath to duplicate the string through alloca(). A local attacker who is able to mount a filesystem on a very long path can crash systemd and the whole system.
Upstream PR: https://github.com/systemd/systemd/pull/20256
Upstream commit: https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
Other sources
A flaw was found in systemd. The use of alloca function with an uncontrolled size in function unitnamepathescape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack. The highest threat from this vulnerability is to the system availability.
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
Systemd is vulnerable to a denial of service, caused by a memory allocation with an excessive size value in basic/unit-name.c. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause the system to crash.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-33910?
CVE-2021-33910 is a vulnerability found in systemd that allows a local attacker to crash the system by allocating a large amount of space in the stack.
What is the severity of CVE-2021-33910?
The severity of CVE-2021-33910 is high with a CVSS score of 6.2.
How does CVE-2021-33910 affect systemd?
CVE-2021-33910 affects systemd by exploiting the use of alloca function with an uncontrolled size in the unit_name_path_escape function, leading to a stack-based buffer overflow.
How can I fix CVE-2021-33910?
To fix CVE-2021-33910, update systemd to version 249 or higher.
Where can I find more information about CVE-2021-33910?
You can find more information about CVE-2021-33910 in the official GitHub repository of systemd.