sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2021-42574 Code injection in n/a

High 8.3 Published Updated

Attackers can hide malicious logic in source code using Unicode control characters, bypassing human review and causing compilers to execute unintended code.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
Available

What is CVE-2021-42574?

CVE-2021-42574 is a high-severity code injection vulnerability in Fedoraproject Fedora, published on 1 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Weakness: CWE-94

Which versions are affected by CVE-2021-42574?

It affects 3 products.

Linux distribution packages (40)
annobin AlmaLinux:8All versions9.72-1.el8_5.2
annobin-annocheck AlmaLinux:8All versions9.72-1.el8_5.2
binutils-devel AlmaLinux:8All versions2.30-108.el8_5.1
cargo AlmaLinux:8All versions1.54.0-3.module_el8.5.0+2599+d655d86c
cargo-doc AlmaLinux:8All versions1.54.0-3.module_el8.5.0+2599+d655d86c
clang AlmaLinux:8All versions12.0.1-4.module_el8.4.0+2600+cefb5d4c
clang-analyzer AlmaLinux:8All versions12.0.1-4.module_el8.4.0+2600+cefb5d4c
clang-devel AlmaLinux:8All versions12.0.1-4.module_el8.4.0+2600+cefb5d4c
clang-libs AlmaLinux:8All versions12.0.1-4.module_el8.4.0+2600+cefb5d4c
clang-resource-filesystem AlmaLinux:8All versions12.0.1-4.module_el8.4.0+2600+cefb5d4c
clang-tools-extra AlmaLinux:8All versions12.0.1-4.module_el8.4.0+2600+cefb5d4c
clippy AlmaLinux:8All versions1.54.0-3.module_el8.5.0+2599+d655d86c
compiler-rt AlmaLinux:8All versions12.0.1-1.module_el8.4.0+2600+cefb5d4c
cpp AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc-c++ AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc-gdb-plugin AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc-gfortran AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc-offload-nvptx AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc-plugin-devel AlmaLinux:8All versions8.5.0-4.el8_5.alma
gcc-toolset-10-annobin AlmaLinux:8All versions9.29-1.el8_5.2
gcc-toolset-10-binutils AlmaLinux:8All versions2.35-8.el8_5.6
gcc-toolset-10-binutils-devel AlmaLinux:8All versions2.35-8.el8_5.6
gcc-toolset-10-gcc AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-gcc-c++ AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-gcc-gdb-plugin AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-gcc-gfortran AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-gcc-plugin-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libasan-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libatomic-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libitm-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-liblsan-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libquadmath-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libstdc++-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libstdc++-docs AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libtsan-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-10-libubsan-devel AlmaLinux:8All versions10.3.1-1.2.el8_5
gcc-toolset-11-annobin-annocheck AlmaLinux:8All versions9.85-1.el8_5.1
gcc-toolset-11-annobin-docs AlmaLinux:8All versions9.85-1.el8_5.1
gcc-toolset-11-annobin-plugin-gcc AlmaLinux:8All versions9.85-1.el8_5.1

Products include Fedoraproject Fedora, Starwindsoftware Starwind Virtual San, Unicode Unicode.

How do I fix CVE-2021-42574?

Apply the vendor's patch.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-42574 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-42574 exists.

Public exploit code: 11 proofs of concept on GitHub.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2021-42574, ALSA-2021:4585, ALSA-2021:4586, ALSA-2021:4587, ALSA-2021:4590, ALSA-2021:4591 and 57 more.

Is CVE-2021-42574 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free