Vulnerability · Published Oct 14, 2021 · Assigned by mitre
CVE-2021-42341
High 7.5
In plain English
A high-severity security flaw in the openrc package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.1%top 18.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | openrc | 0.44.6-r1 | ALPINE-CVE-2021-42341 |
| Alpine:v3.21 | openrc | 0.44.6-r1 | ALPINE-CVE-2021-42341 |
| Alpine:v3.22 | openrc | 0.44.6-r1 | ALPINE-CVE-2021-42341 |
| Alpine:v3.23 | openrc | 0.44.6-r1 | ALPINE-CVE-2021-42341 |
| Alpine:v3.24 | openrc | 0.44.6-r1 | ALPINE-CVE-2021-42341 |
Affected products (as reported)
References
- https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204 x_refsource_MISC
- https://github.com/OpenRC/openrc/issues/459 x_refsource_MISC
- https://github.com/OpenRC/openrc/pull/462 x_refsource_MISC
- https://bugs.gentoo.org/816900 x_refsource_MISC
- https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae x_refsource_MISC
- https://github.com/OpenRC/openrc/issues/418 x_refsource_MISC