Input validation error in Unicode - CVE-2021-42574

Vulnerability identifier: #VU57848

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-42574

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows an attacker to bypass certain security checks.

The vulnerability exists in the Bidirectional Algorithm in the Unicode Specification. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.

An attacker can leverage this behavior to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers.

Unicode
Amazon Linux AMI
Fedora
CentOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
openEuler
Red Hat Developer Tools
Red Hat Software Collections
Rust Programming Language
Discourse
gcc-toolset-10-binutils (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
rust-toolset
rust-std-static-wasm32-unknown-unknown
cargo
clippy
rls
rust
rust-analysis
rust-doc
rust-std-static
rustfmt
cargo-doc
rust-gdb
rust-lldb
rust-debugger-common
rust-src
rust-toolset-1.54-rust (Red Hat package)
binutils (Red Hat package)
binutils-devel
binutils
binutils-debuginfo
binutils-help
binutils-debugsource
gcc-toolset-10-binutils
gcc-toolset-10-binutils-devel
gcc-toolset-11-binutils-devel
gcc-toolset-11-binutils
gcc-toolset-11-binutils (Red Hat package)
gcc (Red Hat package)
libgfortran
cpp
gcc
gcc-c++
gcc-gdb-plugin
gcc-gfortran
libasan
libatomic
libatomic-static
libquadmath-devel
libquadmath
libgomp-offload-nvptx
gcc-offload-nvptx
libubsan
libtsan
libstdc++-docs
libstdc++-devel
libstdc++
liblsan
libitm-devel
libitm
libgomp
libgcc
annobin (Red Hat Package)
gcc-toolset-10-annobin
gcc-toolset-10-annobin (Red Hat package)
annobin-annocheck
annobin
gcc-toolset-11-annobin-annocheck
gcc-toolset-11-annobin-plugin-gcc
gcc-toolset-11-annobin-docs
gcc-toolset-11-annobin (Red Hat package)
devtoolset-10-gcc (Red Hat package)
gcc-toolset-10-gcc
gcc-toolset-10-gcc-c++
gcc-toolset-10-gcc-gdb-plugin
gcc-toolset-10-gcc-gfortran
gcc-toolset-10-libatomic-devel
gcc-toolset-10-libquadmath-devel
gcc-toolset-10-libubsan-devel
gcc-toolset-10-libtsan-devel
gcc-toolset-10-libstdc++-docs
gcc-toolset-10-libstdc++-devel
gcc-toolset-10-liblsan-devel
gcc-toolset-10-libitm-devel
gcc-toolset-10-libasan-devel
gcc-toolset-10-gcc (Red Hat package)
gcc-toolset-11-libstdc++-devel
gcc-toolset-11-libquadmath-devel
libasan6
gcc-toolset-11-libubsan-devel
gcc-toolset-11-libtsan-devel
gcc-toolset-11-libstdc++-docs
gcc-toolset-11-liblsan-devel
gcc-toolset-11-libitm-devel
gcc-toolset-11-libgccjit-docs
gcc-toolset-11-libgccjit-devel
gcc-toolset-11-libgccjit
gcc-toolset-11-libatomic-devel
gcc-toolset-11-libasan-devel
gcc-toolset-11-gcc-plugin-devel
gcc-toolset-11-gcc-gfortran
gcc-toolset-11-gcc-gdb-plugin
gcc-toolset-11-gcc-c++
gcc-toolset-11-gcc
devtoolset-11-gcc (Red Hat package)
gcc-toolset-11-gcc (Red Hat package)
lldb-devel
compiler-rt
llvm-toolset
python3-lldb
libomp
python3-lit
lldb
lld-test
lld-libs
lld-devel
lld
libomp-test
libomp-devel
llvm-googletest
llvm-doc
llvm-test
llvm-static
llvm-libs
llvm-devel
llvm
clang-libs
clang-analyzer
python3-clang
git-clang-format
clang-tools-extra
clang-resource-filesystem
clang-devel
clang
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Red Hat Advanced Cluster Management for Kubernetes
Session Smart Router
Red Hat OpenStack
OpenShift Virtualization
Red Hat OpenShift Serverless
Migration Toolkit for Containers
XtremIO X2
Juniper Junos Space

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Rust Programming Language - update to 1.56.1
Discourse - addressed in versions 2.7.10, 2.8.0 beta8
gcc-toolset-10-binutils (Red Hat package) - addressed in versions 2.35-8.el8_4.5, 2.35-8.el8_5.6
Red Hat Advanced Cluster Security for Kubernetes - update to 3.68
OpenShift Virtualization - update to 4.9.2
OpenShift Logging - addressed in versions 5.0.11, 5.1.6, 5.2.5, 5.3.2
Migration Toolkit for Containers - update to 1.5.4
Red Hat OpenShift Serverless - update to 1.20.0
rust-toolset - update to 1.54.0-1
rust-std-static-wasm32-unknown-unknown - update to 1.54.0-3
cargo - update to 1.54.0-3
clippy - update to 1.54.0-3
rls - update to 1.54.0-3
rust - update to 1.54.0-3
rust-analysis - update to 1.54.0-3
rust-doc - update to 1.54.0-3
rust-std-static - update to 1.54.0-3
rustfmt - update to 1.54.0-3
cargo-doc - update to 1.54.0-3
rust-gdb - update to 1.54.0-3
rust-lldb - update to 1.54.0-3
rust-debugger-common - update to 1.54.0-3
rust-src - update to 1.54.0-3
rust-toolset-1.54-rust (Red Hat package) - update to 1.54.0-4.el7_9
rust - addressed in versions 1.56.1-1.el7, 1.56.1-1.fc33, 1.56.1-1.fc34, 1.56.1-1.fc35
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.2.10, 2.3.6
binutils (Red Hat package) - addressed in versions 2.23.52.0.1-55.el7_2.4, 2.25.1-22.base.el7_3.3, 2.25.1-32.base.el7_4.5, 2.27-34.base.el7_6.4, 2.27-41.base.el7_7.4, 2.27-44.base.el7_9.1, 2.30-58.el8_1.3, 2.30-73.el8_2.1, 2.30-93.el8_4.2, 2.30-108.el8_5.1
binutils-devel - addressed in versions 2.30-73.0.1, 2.30-108.0.1
binutils - addressed in versions 2.30-73.0.1, 2.30-108.0.1
binutils - update to 2.34-19
binutils-debuginfo - update to 2.34-19
binutils-help - update to 2.34-19
binutils-debugsource - update to 2.34-19
binutils-devel - update to 2.34-19
gcc-toolset-10-binutils - update to 2.35-8
gcc-toolset-10-binutils-devel - update to 2.35-8
gcc-toolset-11-binutils-devel - update to 2.36.1-1
gcc-toolset-11-binutils - update to 2.36.1-1
gcc-toolset-11-binutils (Red Hat package) - update to 2.36.1-1.el8_5.1
Session Smart Router - addressed in versions 5.4.7, 5.5.3
XtremIO X2 - update to 6.4.2-13
gcc (Red Hat package) - update to 8.5.0-4.el8_5
libgfortran - update to 8.5.0-4.0.1
cpp - update to 8.5.0-4.0.1
gcc - update to 8.5.0-4.0.1
gcc-c++ - update to 8.5.0-4.0.1
gcc-gdb-plugin - update to 8.5.0-4.0.1
gcc-gfortran - update to 8.5.0-4.0.1
libasan - update to 8.5.0-4.0.1
libatomic - update to 8.5.0-4.0.1
libatomic-static - update to 8.5.0-4.0.1
libquadmath-devel - update to 8.5.0-4.0.1
libquadmath - update to 8.5.0-4.0.1
libgomp-offload-nvptx - update to 8.5.0-4.0.1
gcc-offload-nvptx - update to 8.5.0-4.0.1
libubsan - update to 8.5.0-4.0.1
libtsan - update to 8.5.0-4.0.1
libstdc++-docs - update to 8.5.0-4.0.1
libstdc++-devel - update to 8.5.0-4.0.1
libstdc++ - update to 8.5.0-4.0.1
liblsan - update to 8.5.0-4.0.1
libitm-devel - update to 8.5.0-4.0.1
libitm - update to 8.5.0-4.0.1
libgomp - update to 8.5.0-4.0.1
libgcc - update to 8.5.0-4.0.1
annobin (Red Hat Package) - addressed in versions 8.78-1.el8_1.1, 8.90-1.el8_2.1, 9.50-1.el8_4.1, 9.72-1.el8_5.2
gcc-toolset-10-annobin - update to 9.29-1
gcc-toolset-10-annobin (Red Hat package) - addressed in versions 9.29-1.el8_4.1, 9.29-1.el8_5.2
annobin-annocheck - update to 9.72-1.0.1
annobin - update to 9.72-1.0.1
gcc-toolset-11-annobin-annocheck - update to 9.85-1
gcc-toolset-11-annobin-plugin-gcc - update to 9.85-1
gcc-toolset-11-annobin-docs - update to 9.85-1
gcc-toolset-11-annobin (Red Hat package) - update to 9.85-1.el8_5.1
devtoolset-10-gcc (Red Hat package) - update to 10.2.1-11.2.el7
gcc-toolset-10-gcc - update to 10.3.1-1.2
gcc-toolset-10-gcc-c++ - update to 10.3.1-1.2
gcc-toolset-10-gcc-gdb-plugin - update to 10.3.1-1.2
gcc-toolset-10-gcc-gfortran - update to 10.3.1-1.2
gcc-toolset-10-libatomic-devel - update to 10.3.1-1.2
gcc-toolset-10-libquadmath-devel - update to 10.3.1-1.2
gcc-toolset-10-libubsan-devel - update to 10.3.1-1.2
gcc-toolset-10-libtsan-devel - update to 10.3.1-1.2
gcc-toolset-10-libstdc++-docs - update to 10.3.1-1.2
gcc-toolset-10-libstdc++-devel - update to 10.3.1-1.2
gcc-toolset-10-liblsan-devel - update to 10.3.1-1.2
gcc-toolset-10-libitm-devel - update to 10.3.1-1.2
gcc-toolset-10-libasan-devel - update to 10.3.1-1.2
gcc-toolset-10-gcc (Red Hat package) - update to 10.3.1-1.2.el8_5
gcc-toolset-11-libstdc++-devel - update to 11.2.1-1.2
gcc-toolset-11-libquadmath-devel - update to 11.2.1-1.2
libasan6 - update to 11.2.1-1.2
gcc-toolset-11-libubsan-devel - update to 11.2.1-1.2
gcc-toolset-11-libtsan-devel - update to 11.2.1-1.2
gcc-toolset-11-libstdc++-docs - update to 11.2.1-1.2
gcc-toolset-11-liblsan-devel - update to 11.2.1-1.2
gcc-toolset-11-libitm-devel - update to 11.2.1-1.2
gcc-toolset-11-libgccjit-docs - update to 11.2.1-1.2
gcc-toolset-11-libgccjit-devel - update to 11.2.1-1.2
gcc-toolset-11-libgccjit - update to 11.2.1-1.2
gcc-toolset-11-libatomic-devel - update to 11.2.1-1.2
gcc-toolset-11-libasan-devel - update to 11.2.1-1.2
gcc-toolset-11-gcc-plugin-devel - update to 11.2.1-1.2
gcc-toolset-11-gcc-gfortran - update to 11.2.1-1.2
gcc-toolset-11-gcc-gdb-plugin - update to 11.2.1-1.2
gcc-toolset-11-gcc-c++ - update to 11.2.1-1.2
gcc-toolset-11-gcc - update to 11.2.1-1.2
devtoolset-11-gcc (Red Hat package) - update to 11.2.1-1.2.el7
gcc-toolset-11-gcc (Red Hat package) - update to 11.2.1-1.2.el8_5
gcc - update to 11.3.1-4
lldb-devel - update to 12.0.1-1
compiler-rt - update to 12.0.1-1
llvm-toolset - update to 12.0.1-1
python3-lldb - update to 12.0.1-1
libomp - update to 12.0.1-1
python3-lit - update to 12.0.1-1
lldb - update to 12.0.1-1
lld-test - update to 12.0.1-1
lld-libs - update to 12.0.1-1
lld-devel - update to 12.0.1-1
lld - update to 12.0.1-1
libomp-test - update to 12.0.1-1
libomp-devel - update to 12.0.1-1
llvm-googletest - update to 12.0.1-2
llvm-doc - update to 12.0.1-2
llvm-test - update to 12.0.1-2
llvm-static - update to 12.0.1-2
llvm-libs - update to 12.0.1-2
llvm-devel - update to 12.0.1-2
llvm - update to 12.0.1-2
clang-libs - update to 12.0.1-4
clang-analyzer - update to 12.0.1-4
python3-clang - update to 12.0.1-4
git-clang-format - update to 12.0.1-4
clang-tools-extra - update to 12.0.1-4
clang-resource-filesystem - update to 12.0.1-4
clang-devel - update to 12.0.1-4
clang - update to 12.0.1-4
Red Hat OpenStack - update to 16.2
Juniper Junos Space - update to 22.1R1

• Exploit #9338 - CVE-2021-42574 (Generate malicious files using recently published bidi-attack (CVE-2021-42574)) (September 18, 2023)
• Exploit #6975 - CVE-2021-42574 () (November 2, 2021)
• Exploit #6974 - CVE-2021-42574 (Generate malicious files using recently published bidi-attack (CVE-2021-42574)) (November 2, 2021)

• http://www.openwall.com/lists/oss-security/2021/11/01/1
• http://www.openwall.com/lists/oss-security/2021/11/01/4
• http://www.openwall.com/lists/oss-security/2021/11/01/5
• http://www.openwall.com/lists/oss-security/2021/11/01/6
• https://github.blog/changelog/2021-10-31-warning-about-bidirectional-unicode-text/

• Improper input validation in Unicode Bidirectional Algorithm
• Red Hat Enterprise Linux 7 update for binutils
• Red Hat Enterprise Linux 7.7 update for binutils
• Red Hat Enterprise Linux 7.6 update for binutils
• Red Hat Enterprise Linux AUS 7.4 update for binutils
• Red Hat Enterprise Linux AUS 7.3 update for binutils
• Red Hat Enterprise Linux AUS 7.2 update for binutils
• Red Hat Software Collections update for devtoolset-10-gcc
• Security restrictions bypass in Rust Unicode implementation
• Red Hat Enterprise Linux 8.1 update for binutils
• Red Hat Enterprise Linux 8.2 update for binutils
• Red Hat Enterprise Linux 8.2 update for annobin
• Red Hat Enterprise Linux 8.1 update for annobin
• Red Hat Enterprise Linux 8.4 update for annobin
• Red Hat Enterprise Linux 8.4 update for binutils
• Red Hat Enterprise Linux 8 update for binutils
• Red Hat Enterprise Linux 8 update for gcc-toolset-11-binutils
• Red Hat Enterprise Linux 8 update for annobin
• Red Hat Enterprise Linux 8 update for gcc-toolset-10-annobin
• Red Hat Enterprise Linux 8 update for gcc-toolset-11-annobin
• Red Hat Enterprise Linux 8 update for the rust-toolset:rhel8 module
• Red Hat Enterprise Linux 8.4 update for gcc-toolset-10-annobin
• Red Hat Enterprise Linux 8.4 update for gcc-toolset-10-binutils
• Red Hat Enterprise Linux 8 update for gcc
• Red Hat Enterprise Linux 8 update for gcc-toolset-11-gcc
• Red Hat Enterprise Linux 8 update for gcc-toolset-10-gcc
• Red Hat Enterprise Linux 8 update for gcc-toolset-10-binutils
• Red Hat Software Collections update for devtoolset-11-gcc
• Red Hat Developer Tools update for rust-toolset-1.54-rust
• CentOS 7 update for binutils
• Red Hat Software Collections update for devtoolset-10-annobin
• Red Hat Software Collections update for devtoolset-10-binutils
• Red Hat Software Collections update for devtoolset-11-annobin
• Red Hat Software Collections update for devtoolset-11-binutils
• Red Hat Enterprise Linux 8 update for the llvm-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Logging
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• Multiple vulnerabilities in Junos Space
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• openEuler update for binutils
• Amazon Linux AMI update for gcc
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.20
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Fedora 33 update for rust
• Fedora 35 update for rust
• Fedora EPEL 7 update for rust
• Fedora 34 update for rust
• Multiple vulnerabilities in Dell XtremIO X2
• Anolis OS update for gcc-toolset-10-annobin (Anolis OS 8.4)
• Anolis OS update for gcc-toolset-10-binutils (Anolis OS 8.4)
• Anolis OS update for binutils (Anolis OS 8.2)
• Anolis OS update for gcc
• Anolis OS update for gcc-toolset-10-gcc
• Anolis OS update for gcc-toolset-10-binutils (Anolis OS 8.5)
• Anolis OS update for rust-toolset:an8 module
• Anolis OS update for gcc-toolset-11-gcc
• Anolis OS update for binutils (Anolis OS 8.5)
• Anolis OS update for llvm-toolset:an8 module
• Anolis OS update for gcc-toolset-11-binutils
• Anolis OS update for annobin
• Anolis OS update for gcc-toolset-10-annobin (Anolis OS 8.5)
• Anolis OS update for gcc-toolset-11-annobin
• Multiple vulnerabilities in Discourse
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2