CVE-2021-31873

CRITICAL

klibc < 2.0.9 - Integer Overflow to Heap Buffer Overflow in malloc

Title source: llm

Description

An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow.

References (6)

Core 6

Core References

Mailing List, Release Notes, Third Party Advisory mailing-list

http://www.openwall.com/lists/oss-security/2021/04/30/1

Mailing List, Third Party Advisory mailing-list

https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html

Patch, Third Party Advisory

https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=a31ae8c508fc8d1bca4f57e9f9f88127572d5202

Release Notes, Third Party Advisory

https://kernel.org/pub/linux/libs/klibc/2.0/

Mailing List, Release Notes, Third Party Advisory

https://lists.zytor.com/archives/klibc/2021-April/004593.html

Patch

https://github.com/huolinjue/klibc/commit/a31ae8c508fc8d1bca4f57e9f9f88127572d5202

View Patch ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0215

EPSS Percentile 79.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-190

Status published

Products (2)

debian/debian_linux 9.0

klibc_project/klibc < 2.0.9

Published Apr 30, 2021

Tracked Since Feb 18, 2026