Off-by-one in NGINX Open Source - CVE-2021-23017

Vulnerability identifier: #VU53543

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23017

CWE-ID: CWE-193

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error within the ngx_resolver_copy() function when processing DNS responses. A remote attacker can trigger an off-by-one error, write a dot character (‘.’, 0x2E) out of bounds in a heap allocated buffer and execute arbitrary code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

The vulnerability can be triggered by a DNS response in reply to a DNS request from nginx when the resolver primitive is configured. A specially crafted packet allows overwriting the least significant byte of next heap chunk metadata with 0x2E.

NGINX Open Source
Arch Linux
Gentoo Linux
Amazon Linux AMI
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Enterprise Storage
Fedora
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
openEuler
Junos OS
Red Hat Software Collections
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Oracle Blockchain Platform
Netcool Operations Insight
Northstar Controller
IBM Cloud Pak for Business Automation
nginx (Debian package)
python-pulpcore (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
nginx-light (Ubuntu package)
nginx-full (Ubuntu package)
nginx-extras (Ubuntu package)
nginx-core (Ubuntu package)
nginx-common (Ubuntu package)
nginx (Ubuntu package)
nginx-mod-stream
nginx-filesystem
nginx-all-modules
nginx
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-debuginfo
nginx-debugsource
nginx-source
rh-nginx116-nginx (Red Hat package)
nginx-help
rh-nginx118-nginx (Red Hat package)
HPE SANnav Management Software
Brocade SANnav
Oracle Enterprise Communications Broker
Oracle Enterprise Session Border Controller
Maximo Application Suite - Edge Data Collector
Edgeline EL300 Converged Edge System
Connectrix (Brocade)
PowerFlex rack
IBM API Connect
Oracle Communications Session Border Controller
Juniper Junos Space
Oracle GoldenGate

Install updates from vendor's website.

NGINX Open Source - update to 1.20.1
Ansible Automation Platform - update to 1.2.4
nginx (Debian package) - update to 1.14.2-2+deb10u4
HPE SANnav Management Software - addressed in versions 2.1.1.8, 2.2.0.2
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.1.11, 2.3.3
Brocade SANnav - update to 2.2.0.2
python-pulpcore (Red Hat package) - update to 3.7.6-1.el7pc
automation-hub (Red Hat package) - update to 4.2.5-1.el7pc
python-galaxy-ng (Red Hat package) - update to 4.2.5-2.el7pc
IBM API Connect - update to 5.0.8.12
Maximo Application Suite - Edge Data Collector - update to 8.11.2
Oracle Blockchain Platform - addressed in versions 21.1.2, 21.1.3
Junos OS - addressed in versions 21.4R3-S8, 22.2R3-S5, 22.3R3-S3, 22.4R3-S4, 23.2R2-S2, 23.4R2-S1, 24.2R1
Netcool Operations Insight - update to 1.6.8
nginx-light (Ubuntu package) - addressed in versions 1.10.30ubuntu0.16.04.5+esm1, 1.14.0-0ubuntu1.9, 1.18.0-0ubuntu1.2, 1.18.0-6ubuntu2.2, 1.18.0-6ubuntu8.2
nginx-full (Ubuntu package) - addressed in versions 1.10.30ubuntu0.16.04.5+esm1, 1.14.0-0ubuntu1.9, 1.18.0-0ubuntu1.2, 1.18.0-6ubuntu2.2, 1.18.0-6ubuntu8.2
nginx-extras (Ubuntu package) - addressed in versions 1.10.30ubuntu0.16.04.5+esm1, 1.14.0-0ubuntu1.9, 1.18.0-0ubuntu1.2, 1.18.0-6ubuntu2.2, 1.18.0-6ubuntu8.2
nginx-core (Ubuntu package) - addressed in versions 1.10.30ubuntu0.16.04.5+esm1, 1.14.0-0ubuntu1.9, 1.18.0-0ubuntu1.2, 1.18.0-6ubuntu2.2, 1.18.0-6ubuntu8.2
nginx-common (Ubuntu package) - addressed in versions 1.10.30ubuntu0.16.04.5+esm1, 1.14.0-0ubuntu1.9, 1.18.0-0ubuntu1.2, 1.18.0-6ubuntu2.2, 1.18.0-6ubuntu8.2
nginx (Ubuntu package) - addressed in versions 1.10.30ubuntu0.16.04.5+esm1, 1.14.0-0ubuntu1.9, 1.18.0-0ubuntu1.2, 1.18.0-6ubuntu2.2, 1.18.0-6ubuntu8.2
nginx-mod-stream - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx-filesystem - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx-all-modules - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx-mod-mail - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx-mod-http-xslt-filter - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx-mod-http-perl - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx-mod-http-image-filter - addressed in versions 1.16.1-2.0.1, 1.18.0-3.0.1, 1.20.1-1, 1.20.1-1.0.1
nginx - addressed in versions 1.16.1-3.3.1, 1.16.1-3.15.1, 1.16.1-6.13.1, 1.19.8-3.3.1
nginx-debuginfo - addressed in versions 1.16.1-3.3.1, 1.16.1-3.15.1, 1.16.1-6.13.1, 1.19.8-3.3.1
nginx-debugsource - addressed in versions 1.16.1-3.3.1, 1.16.1-3.15.1, 1.16.1-6.13.1, 1.19.8-3.3.1
nginx-source - addressed in versions 1.16.1-3.3.1, 1.16.1-6.13.1, 1.19.8-3.3.1
rh-nginx116-nginx (Red Hat package) - update to 1.16.1-6.el7
nginx-help - update to 1.16.1-11
nginx-all-modules - update to 1.16.1-11
nginx-filesystem - update to 1.16.1-11
nginx-mod-http-image-filter - update to 1.16.1-11
nginx-mod-stream - update to 1.16.1-11
nginx-debuginfo - update to 1.16.1-11
nginx-debugsource - update to 1.16.1-11
nginx-mod-http-xslt-filter - update to 1.16.1-11
nginx-mod-http-perl - update to 1.16.1-11
nginx-mod-mail - update to 1.16.1-11
nginx - update to 1.16.1-11
rh-nginx118-nginx (Red Hat package) - update to 1.18.0-3.el7
nginx - addressed in versions 1.20.1-1.el7, 1.20.1-1.fc33, 1.20.1-1.fc34, 1.20.1-2.el7, 1.20.1-2.fc33, 1.20.1-2.fc34
Edgeline EL300 Converged Edge System - update to 1.50
Connectrix (Brocade) - addressed in versions 2.1.1.8, 2.2.0.2
PowerFlex rack - update to 3.6.6.0
Northstar Controller - addressed in versions 5.1.0 Service Pack 6, 6.2.2
Oracle GoldenGate - update to 21.4.0.0.0
IBM Cloud Pak for Business Automation - update to 22.0.1.1
Juniper Junos Space - update to 22.1R1

• Exploit #8197 - Nginx 1.20.0 - Denial of Service (DOS) (July 31, 2022)
• Exploit #8103 - CVE-2021-23017-PoC (PoC for Nginx 0.6.18 - 1.20.0 Memory Overwrite Vulnerability CVE-2021-23017) (July 3, 2022)
• Exploit #5486 - X41-2021-002: nginx Resolver Copy Off By One Heap Corruption (May 25, 2021)

• https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
• https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html

• Remote code execution in nginx
• Gentoo update for nginx
• Debian update for nginx
• Amazon Linux AMI update for nginx
• Red Hat Software Collections update for rh-nginx118-nginx
• Red Hat Enterprise Linux 8.4 update for the nginx:1.18 module
• Red Hat Enterprise Linux 8 update for nginx-1.16.1-2.module
• Red Hat Software Collections update for rh-nginx116-nginx
• Arch Linux update for nginx
• Arch Linux update for nginx-mainline
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Remote code execution in Red Hat Automation Platform
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabiltiies in Oracle GoldenGate
• Off-by-one in Oracle Enterprise Communications Broker
• Multiple vulnerabilities in Oracle Enterprise Session Border Controller
• Multiple vulnerabilities in Oracle Communications Session Border Controller
• Red Hat Enterprise Linux 8 update for the nginx:1.20 module
• Multiple vulnerabilities in Oracle Blockchain Platform
• SUSE update for nginx
• SUSE update for nginx
• SUSE update for nginx
• SUSE update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx
• Multiple vulnerabilities in Brocade SANnav
• Multiple vulnerabilities in HPE SANnav Management Software
• Multiple vulnerabilities in Junos Space
• Juniper Networks NorthStar Controller update for nginx
• Remote code execution in IBM API Connect
• Multiple vulnerabilities in IBM Cloud Pak for Automation
• Multiple vulnerabilities in Dell Connectrix
• Multiple vulnerabilities in HPE Edgeline EL300 Converged Edge System
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Off-by-one in IBM Maximo Application Suite - Edge Data Collector Component
• openEuler 20.03 LTS SP1 update for nginx
• Multiple vulnerabilities in Dell PowerFlex Rack
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Junos OS update for nginx
• Fedora 33 update for nginx
• Fedora 34 update for nginx
• Fedora EPEL 7 update for nginx
• Fedora 33 update for nginx
• Fedora EPEL 7 update for nginx
• Fedora 34 update for nginx
• Anolis OS update for nginx:1.16 (Anolis OS 8.2) module
• Anolis OS update for nginx:1.16 (Anolis OS 8.4) module
• Anolis OS update for nginx:1.18 module
• Anolis OS update for nginx:1.20 module
• Anolis OS update for nginx:1.20 module