605
VMScore

CVE-2021-38185

Published: 08/08/2021 Updated: 04/06/2023
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

GNU cpio up to and including 2.13 allows malicious users to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gnu cpio

Vendor Advisories

Debian Bug report logs - #992045 CVE-2021-38185 Package: cpio; Maintainer for cpio is Anibal Monsalve Salazar <anibal@debianorg>; Source for cpio is src:cpio (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Mon, 9 Aug 2021 21:21:01 UTC Severity: grave Tags: security, upstream Found in ...
Synopsis Moderate: cpio security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for cpio is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security ...
Synopsis Important: Red Hat OpenShift Service Mesh 213 Containers security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Service Mesh 213Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed sever ...
Synopsis Important: OpenShift Virtualization 4110 Images security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4110 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a secur ...
概述 Moderate: Red Hat Advanced Cluster Management 2311 security updates and bug fixes 类型/严重性 Security Advisory: Moderate 标题 Red Hat Advanced Cluster Management for Kubernetes 2311 generalavailability release images, which provide security updates and bug fixesRed Hat Product Security has rated this update as having a sec ...
Synopsis Important: OpenShift Container Platform 4110 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4110 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Co ...
Synopsis Moderate: Red Hat Advanced Cluster Management 245 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 245 GeneralAvailability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security ...
GNU cpio through 213 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstringc ds_fgetstr integer overflow that triggers an out-of-bounds heap write NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data (CVE-2021-38185) ...
GNU cpio through 213 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstringc ds_fgetstr integer overflow that triggers an out-of-bounds heap write NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data ...
GNU cpio through 213 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstringc ds_fgetstr integer overflow that triggers an out-of-bounds heap write NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data ...
GNU cpio through 213 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstringc ds_fgetstr integer overflow that triggers an out-of-bounds heap write NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data (CVE-2021-38185) ...

Github Repositories

ACE poc exploit for glibc cpio 2.13 through mmap chunk metadata curruption (CVE-2021-38185)

cpiopwn (CVE-2021-38185) This is an ACE POC of an integer overflow bug in cpio This exploit bypasses all binary protections except full RELRO This exploit uses cpio 213 and libc 231 Video demo: youtube/F0yKJhu7Vak Running the exploit We've provided a Kali Dockerfile to run the exploit The same exploit should work outside the Docker container, but offsets may