Description
checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openrc | 0.44.6-r1 | — |
| Alpine v3.23 | openrc | 0.44.6-r1 | — |
| Alpine v3.22 | openrc | 0.44.6-r1 | — |
| Alpine v3.21 | openrc | 0.44.6-r1 | — |
| Alpine v3.20 | openrc | 0.44.6-r1 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openrc | 0.44.6-r1 | — |
| Alpine v3.18 | openrc | 0.44.6-r1 | — |
| Alpine v3.17 | openrc | 0.44.6-r1 | — |
| Alpine v3.16 | openrc | 0.44.6-r1 | — |
| Alpine v3.15 | openrc | 0.44.6-r1 | — |
| Alpine v3.14 | openrc | 0.43.3-r2 | — |
References
- https://github.com/OpenRC/openrc/commit/bb8334104baf4d5a4a442a8647fb9204738f2204
- https://github.com/OpenRC/openrc/issues/459
- https://github.com/OpenRC/openrc/pull/462
- https://bugs.gentoo.org/816900
- https://github.com/OpenRC/openrc/commit/63db2d99e730547339d1bdd28e8437999c380cae
- https://github.com/OpenRC/openrc/issues/418