CVE-2021-22570 Nullptr Dereference in Protobuf
A null pointer dereference in Protobuf allows attackers to cause a denial of service by providing a malformed proto symbol with a null character.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22570?
CVE-2021-22570 is a medium-severity vulnerability in Debian Debian Linux, published on 26 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Weakness: CWE-476
Which versions are affected by CVE-2021-22570?
13 open source packages ship an affected version, including github.com/protocolbuffers/protobuf, com.google.protobuf:protobuf-java and Google.Protobuf. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/protocolbuffers/protobuf Go | All versions | 0.0.0-20210218195015-ae50d9b99025 |
github.com/protocolbuffers/protobuf Go | All versions | 0.0.0-20210218195015-ae50d9b99025 |
github.com/protocolbuffers/protobuf Go | From 0.0.0 | 3.15.0 |
github.com/protocolbuffers/protobuf Go | From 0.0.0 | 3.15.0 |
com.google.protobuf:protobuf-java Maven | All versions | 3.15.0 |
com.google.protobuf:protobuf-java Maven | All versions | 3.15.0 |
7 more packages
Google.Protobuf NuGet | All versions | 3.15.0 |
Google.Protobuf NuGet | All versions | 3.15.0 |
google/protobuf Packagist | All versions | 3.15.0 |
google/protobuf Packagist | All versions | 3.15.0 |
protobuf PyPI | All versions | 3.15.0 |
protobuf PyPI | All versions | 3.15.0 |
protobuf PyPI | All versions | 3.15.0 |
Linux distribution packages (27)
protobuf AlmaLinux:8 | All versions | 3.5.0-15.el8 |
protobuf-compiler AlmaLinux:8 | All versions | 3.5.0-15.el8 |
protobuf-devel AlmaLinux:8 | All versions | 3.5.0-15.el8 |
protobuf-lite AlmaLinux:8 | All versions | 3.5.0-15.el8 |
protobuf-lite-devel AlmaLinux:8 | All versions | 3.5.0-15.el8 |
python3-protobuf AlmaLinux:8 | All versions | 3.5.0-15.el8 |
protobuf AlmaLinux:9 | All versions | 3.14.0-13.el9 |
protobuf-compiler AlmaLinux:9 | All versions | 3.14.0-13.el9 |
protobuf-devel AlmaLinux:9 | All versions | 3.14.0-13.el9 |
protobuf-lite AlmaLinux:9 | All versions | 3.14.0-13.el9 |
protobuf-lite-devel AlmaLinux:9 | All versions | 3.14.0-13.el9 |
python3-protobuf AlmaLinux:9 | All versions | 3.14.0-13.el9 |
protobuf Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-compiler Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-compiler-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-lite Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-lite-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
python3-protobuf Red Hat:enterprise_linux:8::appstream | All versions | 0:3.5.0-15.el8 |
protobuf-compiler-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.5.0-15.el8 |
protobuf-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.5.0-15.el8 |
protobuf-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:3.5.0-15.el8 |
protobuf-devel Red Hat:enterprise_linux:8::crb | All versions | 0:3.5.0-15.el8 |
protobuf-lite-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.5.0-15.el8 |
protobuf-lite-devel Red Hat:enterprise_linux:8::crb | All versions | 0:3.5.0-15.el8 |
protobuf Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-13.el9 |
Products include Debian Debian Linux, Fedoraproject Fedora, Google Protobuf, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation and 2 more.
How do I fix CVE-2021-22570?
Upgrade github.com/protocolbuffers/protobuf to a fixed version for your release line: 0.0.0-20210218195015-ae50d9b99025 or 3.15.0.
Is CVE-2021-22570 being exploited?
There is no known exploitation of CVE-2021-22570 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2022:7464, ALSA-2022:7970, AZL-9830, CLEANSTART-2026-GA54121, DEBIAN-CVE-2021-22570, GHSA-77rm-9x9h-xj3g and 17 more.