CVE-2021-21404 Crash due to malformed relay protocol message
An attacker can crash the Syncthing relay server or client by sending a malformed message with a negative length field, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21404?
CVE-2021-21404 is a high-severity denial of service vulnerability in syncthing, published on 6 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.
Weakness: CWE-20
Which versions are affected by CVE-2021-21404?
4 open source packages ship an affected version, including github.com/syncthing/syncthing and syncthing. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/syncthing/syncthing Go | All versions | 1.15.0 |
github.com/syncthing/syncthing Go | All versions | 1.15.0 |
github.com/syncthing/syncthing Go | All versions | 1.15.0 |
syncthing Bitnami | All versions | 1.15.0 |
Linux distribution packages (3)
syncthing SUSE:Package Hub 15 SP2 | All versions | 1.15.1-bp152.2.3.1 |
syncthing openSUSE:Leap 15.2 | All versions | 1.15.1-lp152.2.3.1 |
syncthing openSUSE:Tumbleweed | All versions | 1.18.2-2.1 |
Products include Syncthing Syncthing.
How do I fix CVE-2021-21404?
Upgrade github.com/syncthing/syncthing to 1.15.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21404 being exploited?
There is no known exploitation of CVE-2021-21404 in the wild and no public exploit code.
Other vulnerabilities in syncthing
Sources
Also known as BIT-syncthing-2021-21404, DEBIAN-CVE-2021-21404, GHSA-x462-89pf-6r5h, GO-2022-0888, UBUNTU-CVE-2021-21404, openSUSE-SU-2021:0688-1 and 2 more.