Heap-based buffer overflow in SoX - CVE-2021-23172

Vulnerability identifier: #VU73928

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23172

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the startread() function in hcom.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and crash the application.

SoX
Debian Linux
Ubuntu
libsox2 (Ubuntu package)
sox (Ubuntu package)
libsox3 (Ubuntu package)
sox (Debian package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libsox2 (Ubuntu package) - update to Ubuntu Pro
sox (Ubuntu package) - addressed in versions Ubuntu Pro, 14.4.2+git20190427-3ubuntu0.1, 14.4.2+git20190427-3ubuntu0.2, 14.4.2+git20190427-2+deb11u1build0.20.04.1, 14.4.2+git20190427-2+deb11u1build0.22.04.1, 14.4.2+git20190427-2+deb11u2build0.20.04.1, 14.4.2+git20190427-2+deb11u2build0.22.04.1, 14.4.2-3ubuntu0.18.04.2, 14.4.2-3ubuntu0.18.04.3
libsox3 (Ubuntu package) - addressed in versions 14.4.2+git20190427-3ubuntu0.1, 14.4.2+git20190427-3ubuntu0.2, 14.4.2+git20190427-2+deb11u1build0.20.04.1, 14.4.2+git20190427-2+deb11u1build0.22.04.1, 14.4.2+git20190427-2+deb11u2build0.20.04.1, 14.4.2+git20190427-2+deb11u2build0.22.04.1, 14.4.2-3ubuntu0.18.04.2, 14.4.2-3ubuntu0.18.04.3
sox (Debian package) - update to 14.4.2+git20190427-2+deb11u1

• https://bugzilla.redhat.com/show_bug.cgi?id=1975666
• https://sourceforge.net/p/sox/bugs/350/
• https://access.redhat.com/security/cve/CVE-2021-23172
• https://security.archlinux.org/CVE-2021-23172

• Multiple vulnerabilities in SoX
• Ubuntu update for sox
• Ubuntu update for sox
• Debian update for sox