Integer overflow in klibc - CVE-2021-31871

Vulnerability identifier: #VU62376

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31871

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in the cpio command. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

klibc
klibc-utils (Ubuntu package)
libklibc (Ubuntu package)
VMware Tanzu Application Service for VMs
Isolation Segment
cflinuxfs3
CloudLink
Ubuntu
VMware Tanzu Operations Manager

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

klibc - update to 2.0.9
cflinuxfs3 - update to 0.286.0
klibc-utils (Ubuntu package) - addressed in versions 2.0.4-9ubuntu2.1, 2.0.7-1ubuntu5.1
libklibc (Ubuntu package) - addressed in versions 2.0.4-9ubuntu2.1, 2.0.7-1ubuntu5.1
VMware Tanzu Operations Manager - addressed in versions 2.9.38, 2.10.39
CloudLink - update to 7.1.4

• https://kernel.org/pub/linux/libs/klibc/2.0/
• https://lists.zytor.com/archives/klibc/2021-April/004593.html
• https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=2e48a12ab1e30d43498c2d53e878a11a1b5102d5
• http://www.openwall.com/lists/oss-security/2021/04/30/1
• https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html

• Multiple vulnerabilities in klibc
• Multiple vulnerabilities in cflinuxfs3
• Ubuntu update for klibc
• VMware Tanzu products update for klibc
• Multiple vulnerabilities in Dell CloudLink