Log in Start free

Vulnerability · Published Jun 2, 2021 · Assigned by redhat

CVE-2021-3520

Critical 9.8

In plain English

A critical-severity integer overflow in lz4. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.4%top 11.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8lz41.8.3-3.el8_4ALSA-2021:2575
AlmaLinux:8lz4-devel1.8.3-3.el8_4ALSA-2021:2575
AlmaLinux:8lz4-libs1.8.3-3.el8_4ALSA-2021:2575
Alpine:v3.20lz41.9.3-r1ALPINE-CVE-2021-3520
Alpine:v3.21lz41.9.3-r1ALPINE-CVE-2021-3520
Alpine:v3.22lz41.9.3-r1ALPINE-CVE-2021-3520
Alpine:v3.23lz41.9.3-r1ALPINE-CVE-2021-3520
Alpine:v3.24lz41.9.3-r1ALPINE-CVE-2021-3520
Debian:12lz41.9.3-2DEBIAN-CVE-2021-3520
Debian:13lz41.9.3-2DEBIAN-CVE-2021-3520
Debian:14lz41.9.3-2DEBIAN-CVE-2021-3520
Rocky Linux:8lz40:1.8.3-3.el8_4RLSA-2021:2575

Affected products (as reported)

VendorProductVersions
n/a lz4 lz4-1.8.3

Weakness: CWE-190

References