CVE-2021-44847 Memory corruption in n/a
Remote attackers can trigger a stack-based buffer overflow in toxcore via network packets, leading to process crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44847?
CVE-2021-44847 is a critical memory corruption vulnerability in Fedoraproject Fedora, published on 13 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet.
Weakness: CWE-682
Which versions are affected by CVE-2021-44847?
It affects 2 products.
Linux distribution packages (6)
c-toxcore SUSE:Package Hub 15 SP1 | All versions | 0.2.13-bp153.2.3.1 |
c-toxcore SUSE:Package Hub 15 SP2 | All versions | 0.2.13-bp153.2.3.1 |
c-toxcore SUSE:Package Hub 15 SP3 | All versions | 0.2.13-bp153.2.3.1 |
c-toxcore openSUSE:Leap 15.2 | All versions | 0.2.13-bp153.2.3.1 |
c-toxcore openSUSE:Leap 15.3 | All versions | 0.2.13-bp153.2.3.1 |
qtox openSUSE:Tumbleweed | All versions | 1.17.4-1.1 |
Products include Fedoraproject Fedora, Toktok Toxcore.
How do I fix CVE-2021-44847?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-44847 being exploited?
There is no known exploitation of CVE-2021-44847 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2021-44847, GHSA-62pr-4hg6-fwph, MGASA-2021-0596, UBUNTU-CVE-2021-44847, openSUSE-SU-2021:1640-1, openSUSE-SU-2024:11846-1.