CVE-2021-33640 is a critical use-after-free vulnerability in libtar.c, specifically affecting Fedora and OpenEuler distributions. The flaw occurs when the tar_close() function releases memory that is subsequently accessed, leading to potential system compromise. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with no user interaction, allowing for high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the severe nature of the vulnerability warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20.03CPE matchmatch criteria | cpe:2.3:o:openatom:openeuler:20.03:sp1:*:*:lts:*:*:* | ||
20.03CPE matchmatch criteria | cpe:2.3:o:openatom:openeuler:20.03:sp2:*:*:lts:*:*:* | ||
22.03CPE matchmatch criteria | cpe:2.3:o:openatom:openeuler:22.03:*:*:*:lts:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
37CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-33640
Jun 11, 2024After tar_close() libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result the released memory is used (use-after-free).
Dec 13, 2022libtar: fixes for CVE-2021-33645 and CVE-2021-33646 introduced new use-after-free bugs in libtar
Dec 9, 2022