Vulnerability · Published Aug 9, 2022 · Assigned by openEuler
CVE-2021-33646
High 7.5
In plain English
A high-severity memory leak in libtar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.0%top 19.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libtar | 1.2.20-17.el8 | ALSA-2023:2898 |
| Debian:12 | libtar | 1.2.20-8+deb12u1 | DEBIAN-CVE-2021-33646 |
| Rocky Linux:8 | libtar | 0:1.2.20-17.el8 | RLSA-2023:2898 |
| Ubuntu:22.04:LTS | libtar | 1.2.20-8ubuntu0.22.04.1 | UBUNTU-CVE-2021-33646 |
| Ubuntu:22.04:LTS | libtar | 1.2.20-8ubuntu0.22.04.1 | USN-7398-1 |
| Ubuntu:24.04:LTS | libtar | 1.2.20-8.1ubuntu0.24.04.1 | USN-7398-1 |
| Ubuntu:24.04:LTS | libtar | 1.2.20-8.1ubuntu0.24.04.1 | UBUNTU-CVE-2021-33646 |
Affected products (as reported)
Weakness: CWE-401
References
- https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807
- FEDORA-2022-fe1a4e3cf0 vendor-advisory
- FEDORA-2022-50e8a1b51d vendor-advisory
- FEDORA-2022-44a20bba43 vendor-advisory
- FEDORA-2022-88772d0a2d vendor-advisory
- FEDORA-2022-ccc68b06cc vendor-advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00026.html