IM
IronMonkey Threat Research

CVE-2021-3826 MEDIUM

Published: 2022-09-01 | Last Modified: 2024-11-21 | Status: Modified

Description

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

Additional Descriptions (1)

Un desbordamiento del búfer de la pila en la función dlang_lname en el archivo d-demangle.c en libiberty permite a atacantes causar potencialmente una denegación de servicio (fallo de segmentación y caída) por medio de un símbolo mangled diseñado

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-119
[email protected] Secondary
en CWE-787

Affected Products

Vendor Product Version Update Type
gnu gcc 11.2 <built-in method update of dict object at 0x7fd3844a0dc0> Application
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd3844a2b80> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd3845ff8c0> Operating System
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd3845fd240> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnu:gcc:11.2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

References