CVE-2021-43618
gmp: Integer overflow and resultant buffer overflow via crafted input
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
GNU Multiple Precision Arithmetic Library (GMP) versiones hasta 6.2.1, presenta un desbordamiento de enteros mpz/inp_raw.c y un desbordamiento de búfer resultante por medio de una entrada diseñada, conllevando a un fallo de segmentación en plataformas de 32 bits
A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The highest threat from this vulnerability is to system availability.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-11-15 CVE Reserved
- 2021-11-15 CVE Published
- 2024-07-31 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2022/Oct/8 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2022/10/13/3 | Mailing List |
|
| https://bugs.debian.org/994405 | Mailing List | |
| https://lists.debian.org/debian-lts-announce/2021/12/msg00001.html | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20221111-0001 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://gmplib.org/list-archives/gmp-bugs/2021-September/005077.html | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://gmplib.org/repo/gmp-6.2/rev/561a9c25298e | 2023-09-29 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202309-13 | 2023-09-29 | |
| https://access.redhat.com/security/cve/CVE-2021-43618 | 2024-05-22 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2024904 | 2024-05-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Netapp Search vendor "Netapp" | H300s Firmware Search vendor "Netapp" for product "H300s Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | H300s Search vendor "Netapp" for product "H300s" | - | - |
Safe
|
| Netapp Search vendor "Netapp" | H500s Firmware Search vendor "Netapp" for product "H500s Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | H500s Search vendor "Netapp" for product "H500s" | - | - |
Safe
|
| Netapp Search vendor "Netapp" | H700s Firmware Search vendor "Netapp" for product "H700s Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | H700s Search vendor "Netapp" for product "H700s" | - | - |
Safe
|
| Netapp Search vendor "Netapp" | H410s Firmware Search vendor "Netapp" for product "H410s Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | H410s Search vendor "Netapp" for product "H410s" | - | - |
Safe
|
| Netapp Search vendor "Netapp" | H410c Firmware Search vendor "Netapp" for product "H410c Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | H410c Search vendor "Netapp" for product "H410c" | - | - |
Safe
|
| Gmplib Search vendor "Gmplib" | Gmp Search vendor "Gmplib" for product "Gmp" | <= 6.2.1 Search vendor "Gmplib" for product "Gmp" and version " <= 6.2.1" | x86 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||