Vulnerabilities > CVE-2021-33640 - Use After Free vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

huawei

fedoraproject

CWE-416

critical

NVD

Published: 2022-12-19

Updated: 2024-11-21

Summary

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Vulnerable Configurations

Part	Description	Count
OS	Huawei Huawei Openeuler 20.03 Huawei Openeuler 22.03	3
OS	Fedoraproject Fedoraproject Fedora 36 Fedoraproject Fedora 37	2

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar