CVE-2021-22332 Use after free in CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800

High 7.5 Published 28 Apr 2021 Updated 3 Aug 2024

Attackers can cause a module crash and service disruption on Huawei CloudEngine switches by exploiting a pointer double free vulnerability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22332?

CVE-2021-22332 is a high-severity use after free vulnerability in CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800, published on 28 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. When a function is called, the same memory pointer is copied to two functional modules. Attackers can exploit this vulnerability by performing a malicious operation to cause the pointer double free. This may lead to module crash, compromising normal service.

Weakness: CWE-415

Which versions are affected by CVE-2021-22332?

It affects 4 products.

Products include Huawei Cloudengine 12800 Firmware, Huawei Cloudengine 5800 Firmware, Huawei Cloudengine 6800 Firmware, Huawei Cloudengine 7800 Firmware.

How do I fix CVE-2021-22332?

No fix has been published for CVE-2021-22332 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-22332 being exploited?

There is no known exploitation of CVE-2021-22332 in the wild and no public exploit code.

Sources

Also known as GHSA-g9cv-62xc-fj2v.