Skip to content
OpenAdvisories
Unscored Public exploit CVE-2021-42574 EUVD-2021-29541

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of chara…

Published Nov 1, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: chromium-rust Package: rust Package: rustc Package: rustc Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rustc 1.57.0+dfsg1-1 —
Debian 13 rustc 1.57.0+dfsg1-1 —
Debian 12 rustc 1.57.0+dfsg1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS rustc 1.57.0+dfsg1+llvm-0ubuntu2 —
Ubuntu 20.04 LTS rustc 1.57.0+dfsg1+llvm-0ubuntu1~20.04.1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 annobin +1 9.72-1.el8_5.2 RHSA-2021:4593
RHEL 8 binutils +1 2.30-108.el8_5.1 RHSA-2021:4595
RHEL 8 clang +7 12.0.1-4.module+el8.5.0+13246+cefb5d4c RHSA-2021:4743
RHEL 8 cpp +24 8.5.0-4.el8_5 RHSA-2021:4587
RHEL 8 gcc-toolset-10-annobin 9.29-1.el8_5.2 RHSA-2021:4592
RHEL 8 gcc-toolset-10-binutils +1 2.35-8.el8_5.6 RHSA-2021:4649
RHEL 8 gcc-toolset-11-annobin +3 9.85-1.el8_5.1 RHSA-2021:4591
RHEL 8 gcc-toolset-11-binutils +1 2.36.1-1.el8_5.1 RHSA-2021:4594
RHEL 8 gcc-toolset-11-gcc +16 11.2.1-1.2.el8_5 RHSA-2021:4586
RHEL 8 libasan6 +14 10.3.1-1.2.el8_5 RHSA-2021:4586, RHSA-2021:4585
RHEL 8 lld +13 12.0.1-1.module+el8.5.0+11871+08d0eab5 RHSA-2021:4743
RHEL 8 llvm +6 12.0.1-2.module+el8.5.0+12488+254d2a07 RHSA-2021:4743
RHEL 8 rls +13 1.54.0-3.module+el8.5.0+13074+d655d86c RHSA-2021:4590
RHEL 8 rust-toolset 1.54.0-1.module+el8.5.0+12195+effd8a03 RHSA-2021:4590
RHEL 7 binutils +1 2.27-44.base.el7_9.1 RHSA-2021:4033
RHEL 3 devtoolset-10-annobin +1 9.23-4.el7.1 RHSA-2021:4724
RHEL 3 devtoolset-10-binutils +1 2.35-5.el7.3 RHSA-2021:4723
RHEL 3 devtoolset-11-annobin +3 9.82-1.el7.1 RHSA-2021:4729
RHEL 3 devtoolset-11-binutils +1 2.36.1-1.el7.1 RHSA-2021:4730
RHEL 3 devtoolset-11-gcc +16 11.2.1-1.2.el7 RHSA-2021:4669
RHEL 3 liblsan +20 10.2.1-11.2.el7 RHSA-2021:4669, RHSA-2021:4039
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.4 EUS annobin +1 9.50-1.el8_4.1 RHSA-2021:4598
RHEL 8.4 EUS binutils +1 2.30-93.el8_4.2 RHSA-2021:4596
RHEL 8.4 EUS gcc-toolset-10-annobin 9.29-1.el8_4.1 RHSA-2021:4589
RHEL 8.4 EUS gcc-toolset-10-binutils +1 2.35-8.el8_4.5 RHSA-2021:4588
RHEL 8.2 EUS annobin 8.90-1.el8_2.1 RHSA-2021:4600
RHEL 8.2 EUS binutils +1 2.30-73.el8_2.1 RHSA-2021:4601
RHEL 8.1 EUS annobin 8.78-1.el8_1.1 RHSA-2021:4599
RHEL 8.1 EUS binutils +1 2.30-58.el8_1.3 RHSA-2021:4602
RHEL 7.7 TUS binutils +1 2.27-41.base.el7_7.4 RHSA-2021:4034
RHEL 7.7 E4S binutils +1 2.27-41.base.el7_7.4 RHSA-2021:4034
RHEL 7.7 AUS binutils +1 2.27-41.base.el7_7.4 RHSA-2021:4034
RHEL 7.6 TUS binutils +1 2.27-34.base.el7_6.4 RHSA-2021:4035
RHEL 7.6 E4S binutils +1 2.27-34.base.el7_6.4 RHSA-2021:4035
RHEL 7.6 AUS binutils +1 2.27-34.base.el7_6.4 RHSA-2021:4035
RHEL 7.4 AUS binutils +1 2.25.1-32.base.el7_4.5 RHSA-2021:4036
RHEL 7.3 AUS binutils +1 2.25.1-22.base.el7_3.3 RHSA-2021:4037
RHEL 7.2 AUS binutils +1 2.23.52.0.1-55.el7_2.4 RHSA-2021:4038
Red Hat Devtools 2021 rust-toolset-1.54-rls +12 1.54.0-4.el7_9 RHSA-2021:4694

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 annobin +1 9.72-1.el8_5.2 ALSA-2021:4593
AlmaLinux 8 binutils-devel 2.30-108.el8_5.1 ALSA-2021:4595
AlmaLinux 8 clang +7 12.0.1-4.module_el8.4.0+2600+cefb5d4c ALSA-2021:4743
AlmaLinux 8 cpp +11 8.5.0-4.el8_5.alma ALSA-2021:4587
AlmaLinux 8 gcc-toolset-10-annobin 9.29-1.el8_5.2 ALSA-2021:4592
AlmaLinux 8 gcc-toolset-10-binutils +1 2.35-8.el8_5.6 ALSA-2021:4649
AlmaLinux 8 gcc-toolset-11-annobin-docs +2 9.85-1.el8_5.1 ALSA-2021:4591
AlmaLinux 8 gcc-toolset-11-binutils +1 2.36.1-1.el8_5.1 ALSA-2021:4594
AlmaLinux 8 gcc-toolset-11-gcc +16 11.2.1-1.2.el8_5 ALSA-2021:4586
AlmaLinux 8 libasan6 +14 10.3.1-1.2.el8_5 ALSA-2021:4586, ALSA-2021:4585
AlmaLinux 8 lld +12 12.0.1-1.module_el8.4.0+2600+cefb5d4c ALSA-2021:4743
AlmaLinux 8 llvm +6 12.0.1-2.module_el8.4.0+2600+cefb5d4c ALSA-2021:4743
AlmaLinux 8 rls +13 1.54.0-3.module_el8.5.0+2599+d655d86c ALSA-2021:4590
AlmaLinux 8 rust-toolset 1.54.0-1.module_el8.5.0+2599+d655d86c ALSA-2021:4590

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 annobin 9.72-1.el8_5.2 RLSA-2021:4593
Rocky Linux 8 binutils 2.30-108.el8_5.1 RLSA-2021:4595
Rocky Linux 8 clang 12.0.1-4.module+el8.5.0+715+58f51d49 RLSA-2021:4743
Rocky Linux 8 gcc 8.5.0-4.el8_5 RLSA-2021:4587
Rocky Linux 8 gcc-toolset-10-annobin 9.29-1.el8_5.2 RLSA-2021:4592
Rocky Linux 8 gcc-toolset-10-binutils 2.35-8.el8_5.6 RLSA-2021:4649
Rocky Linux 8 gcc-toolset-10-gcc 10.3.1-1.2.el8_5 RLSA-2021:4585
Rocky Linux 8 gcc-toolset-11-annobin 9.85-1.el8_5.1 RLSA-2021:4591
Rocky Linux 8 gcc-toolset-11-binutils 2.36.1-1.el8_5.1 RLSA-2021:4594
Rocky Linux 8 gcc-toolset-11-gcc 11.2.1-1.2.el8_5 RLSA-2021:4586
Rocky Linux 8 lld +5 12.0.1-1.module+el8.5.0+692+8756646f RLSA-2021:4743
Rocky Linux 8 llvm 12.0.1-2.module+el8.5.0+692+8756646f RLSA-2021:4743
Rocky Linux 8 rust 1.54.0-3.module+el8.5.0+712+d335422a RLSA-2021:4590
Rocky Linux 8 rust-toolset 1.54.0-1.module+el8.5.0+678+cf7bc64b RLSA-2021:4590

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rust1.56 1.56.1-1.1 openSUSE-SU-2024:11650-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 rust +1 1.56.1-r0 —
Alpine v3.23 rust 1.56.1-r0 —
Alpine v3.22 rust 1.56.1-r0 —
Alpine v3.21 rust 1.56.1-r0 —
Alpine v3.20 rust 1.56.1-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 rust 1.56.1-r0 —
Alpine v3.18 rust 1.56.1-r0 —
Alpine v3.17 rust 1.56.1-r0 —
Alpine v3.16 rust 1.56.1-r0 —
Alpine v3.15 rust 1.56.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cpp +33 11.3.1-4.amzn2023.0.2 ALAS2023-2023-030
Amazon Linux 2 cpp +25 7.3.1-14.amzn2 ALAS2-2022-1784
Amazon Linux 2 cpp10 +11 10.3.1-1.amzn2.0.2 ALAS2-2022-1784

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 annobin +1 9.72-1.el8_5.2 ELSA-2021-4593
Oracle Linux 8 binutils +1 2.30-108.0.2.el8_5.1 ELSA-2021-4595
Oracle Linux 8 clang +7 12.0.1-4.0.1.module+el8.5.0+20428+2b4ecd47 ELSA-2021-4743
Oracle Linux 8 cpp +24 8.5.0-4.0.1.el8_5 ELSA-2021-4587
Oracle Linux 8 gcc-toolset-10-annobin 9.29-1.el8_5.2 ELSA-2021-4592
Oracle Linux 8 gcc-toolset-10-binutils +1 2.35-8.el8_5.6 ELSA-2021-4649
Oracle Linux 8 gcc-toolset-11-annobin-docs +2 9.85-1.el8_5.1 ELSA-2021-4591
Oracle Linux 8 gcc-toolset-11-binutils +1 2.36.1-1.0.1.el8_5.1 ELSA-2021-4594
Oracle Linux 8 gcc-toolset-11-gcc +16 11.2.1-1.2.0.1.el8_5 ELSA-2021-4586
Oracle Linux 8 libasan6 +14 10.3.1-1.2.0.1.el8_5 ELSA-2021-4586, ELSA-2021-4585
Oracle Linux 8 lld +12 12.0.1-1.module+el8.5.0+20373+e968e4f5 ELSA-2021-4743
Oracle Linux 8 llvm +6 12.0.1-2.0.1.module+el8.5.0+20406+58ff08d7 ELSA-2021-4743
Oracle Linux 8 rls +13 1.54.0-3.module+el8.5.0+20427+a847b747 ELSA-2021-4590
Oracle Linux 8 rust-toolset 1.54.0-1.module+el8.5.0+20381+6e029bfc ELSA-2021-4590
Oracle Linux 7 binutils +1 2.27-44.base.0.3.el7_9.1 ELSA-2021-4033

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 11 repositories · most starred shown

  • simplylu/CVE-2021-42574 ★ 8 · Nov 2, 2021

    Generate malicious files using recently published bidi-attack (CVE-2021-42574)

  • maweil/bidi_char_detector ★ 6 · Nov 6, 2021

    Checks your files for existence of Unicode BIDI characters which can be misused for supply chain attacks. See CVE-2021-42574

  • rakib-nyc/nullorigin ★ 5 · Aug 16, 2026

    Research-only AI watermark & provenance robustness toolkit: local reverse proxy (OpenAI/Anthropic/Gemini) + CLI stripping C2PA/EXIF/XMP, zero-width & homoglyph Unicode, KGW text watermarks, DWT/Tree-…

  • Moshe-ship/bidi-guard ★ 5 · Mar 21, 2026

    Scan code for invisible bidirectional Unicode characters (Trojan Source attack prevention, CVE-2021-42574)

  • tin-z/solidity_CVE-2021-42574-POC ★ 3 · Jan 31, 2023

    POC of CVE-2021-42574 for solidity and solc compiler

  • waseeld/CVE-2021-42574 ★ 1 · Dec 11, 2021
  • sotiak/CVE-2021-42574 ★ 1 · Nov 1, 2021
  • hffaust/CVE-2021-42574_and_CVE-2021-42694 ★ 1 · Nov 1, 2021
  • gitstq/GlyphGuard ★ 0 · Oct 16, 2026

    🔥 GlyphGuard — Lightweight Unicode Homoglyph & Invisible-Character Security Audit Engine | 轻量级 Unicode 同形字与不可见字符安全审计引擎 — Zero Dependencies, Trojan Source (CVE-2021-42574) Detection, Skeleton Mapping,…

  • pierDipi/unicode-control-characters-action ★ 0 · Nov 25, 2021

    A GitHub Action to find Unicode control characters using the Red Hat diagnostic tool https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 to detect RHSB-2021-007 Trojan source attacks (CV…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 50

References