CVE-2021-33643 is a critical vulnerability affecting libtar and related Fedora/OpenEuler products, allowing an unauthenticated attacker to trigger an out-of-bounds read. By submitting a specially crafted tar file with a zero-sized header, an attacker can cause a malloc(0) call, leading to a denial of service or potentially information disclosure. With a CVSS score of 9.1 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector and low attack complexity. Currently, there is no public exploit code available, and it is not known to be actively exploited, with minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.21CPE matchmatch criteria | cpe:2.3:a:feep:libtar:*:*:*:*:*:*:*:* | ||
20.03CPE matchmatch criteria | cpe:2.3:o:openatom:openeuler:20.03:sp1:*:*:lts:*:*:* | ||
20.03CPE matchmatch criteria | cpe:2.3:o:openatom:openeuler:20.03:sp3:*:*:lts:*:*:* | ||
22.03CPE matchmatch criteria | cpe:2.3:o:openatom:openeuler:22.03:*:*:*:lts:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-33643
Jun 11, 2024libtar: out-of-bounds read in gnu_longlink
Aug 10, 2022An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink causing an out-of-bounds read.
Aug 9, 2022