CVE-2021-38185 describes an integer overflow vulnerability in GNU cpio versions through 2.13, specifically in the ds_fgetstr function, which can lead to an out-of-bounds heap write and arbitrary code execution via a crafted pattern file. This vulnerability carries a high CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability, with a local attack vector and low attack complexity, though user interaction is required. While the EPSS score suggests a higher than average exploitability, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is there any evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.13CPE matchmatch criteria | cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file associated with the -E option is untrusted data.
Aug 10, 2021cpio: integer overflow in ds_fgetstr() in dstring.c can lead to an out-of-bounds write via a crafted pattern file
Aug 6, 2021