Vulnerability · Published Aug 9, 2022 · Assigned by openEuler
CVE-2021-33644
High 8.1
In plain English
A high-severity out-of-bounds read in libtar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.1High
Exploit odds (30 days)1.6%top 24.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libtar | 1.2.20-17.el8 | ALSA-2023:2898 |
| Debian:12 | libtar | 1.2.20-8+deb12u1 | DEBIAN-CVE-2021-33644 |
| Rocky Linux:8 | libtar | 0:1.2.20-17.el8 | RLSA-2023:2898 |
| Ubuntu:22.04:LTS | libtar | 1.2.20-8ubuntu0.22.04.1 | UBUNTU-CVE-2021-33644 |
| Ubuntu:22.04:LTS | libtar | 1.2.20-8ubuntu0.22.04.1 | USN-7398-1 |
| Ubuntu:24.04:LTS | libtar | 1.2.20-8.1ubuntu0.24.04.1 | USN-7398-1 |
| Ubuntu:24.04:LTS | libtar | 1.2.20-8.1ubuntu0.24.04.1 | UBUNTU-CVE-2021-33644 |
Affected products (as reported)
Weakness: CWE-125
References
- https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807
- FEDORA-2022-fe1a4e3cf0 vendor-advisory
- FEDORA-2022-50e8a1b51d vendor-advisory
- FEDORA-2022-44a20bba43 vendor-advisory
- FEDORA-2022-88772d0a2d vendor-advisory
- FEDORA-2022-ccc68b06cc vendor-advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00026.html