CVE-2021-33844 Denial of service in SoX (Sound eXchange)

Medium 5.5 Published 25 Aug 2022 Updated 3 Aug 2024

An attacker can cause a denial of service via a crafted WAV file triggering a divide-by-zero error in SoX.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-33844?

CVE-2021-33844 is a medium-severity denial of service vulnerability in SoX (Sound eXchange), published on 25 Aug 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash.

Weakness: CWE-369

Which versions are affected by CVE-2021-33844?

It affects 1 product.

Products include Sound Exchange Project Sound Exchange.

How do I fix CVE-2021-33844?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-33844 being exploited?

There is no known exploitation of CVE-2021-33844 in the wild and no public exploit code.

Sources

Also known as AZL-44017, AZL-44664, DEBIAN-CVE-2021-33844, GHSA-3q4f-g8fc-j65f, UBUNTU-CVE-2021-33844, USN-5904-2.