Integer overflow in klibc - CVE-2021-31872

Vulnerability identifier: #VU62377

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31872

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the cpio command. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

klibc
klibc-utils (Ubuntu package)
libklibc (Ubuntu package)
VMware Tanzu Application Service for VMs
Isolation Segment
cflinuxfs3
CloudLink
Ubuntu
VMware Tanzu Operations Manager

Install updates from vendor's website.

klibc - update to 2.0.9
cflinuxfs3 - update to 0.286.0
klibc-utils (Ubuntu package) - addressed in versions 2.0.4-9ubuntu2.1, 2.0.7-1ubuntu5.1
libklibc (Ubuntu package) - addressed in versions 2.0.4-9ubuntu2.1, 2.0.7-1ubuntu5.1
VMware Tanzu Operations Manager - addressed in versions 2.9.38, 2.10.39
CloudLink - update to 7.1.4

• https://kernel.org/pub/linux/libs/klibc/2.0/
• https://lists.zytor.com/archives/klibc/2021-April/004593.html
• https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=9b1c91577aef7f2e72c3aa11a27749160bd278ff
• http://www.openwall.com/lists/oss-security/2021/04/30/1
• https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html

• Multiple vulnerabilities in klibc
• Multiple vulnerabilities in cflinuxfs3
• Ubuntu update for klibc
• VMware Tanzu products update for klibc
• Multiple vulnerabilities in Dell CloudLink