CVE-2021-38441 Eclipse CycloneDDS Write-what-where Condition
An attacker can exploit a write-what-where condition in the XML parser to write arbitrary values, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38441?
CVE-2021-38441 is a medium-severity memory corruption vulnerability in Eclipse CycloneDDS, published on 5 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
Weakness: CWE-123
Which versions are affected by CVE-2021-38441?
It affects 1 product.
Products include Eclipse Cyclonedds.
How do I fix CVE-2021-38441?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-38441 being exploited?
There is no known exploitation of CVE-2021-38441 in the wild and no public exploit code.
Other vulnerabilities in Eclipse CycloneDDS
Sources
Also known as DEBIAN-CVE-2021-38441, GHSA-9v3v-pqhw-3fhr, UBUNTU-CVE-2021-38441.