Integer Overflow and Buffer Overflow in GNU Multiple Precision Arithmetic Library (GMP)
Summary
CVE-2021-43618: GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. Affects gmp versions < 6.2.1-r1. Fixed in 6.2.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU Multiple Precision Arithmetic Library (GMP) is a widely used open-source library for performing arithmetic operations on large integers and floating-point numbers. It provides a rich set of functions for efficient and accurate mathematical computations. However, a vulnerability has been discovered in GMP versions up to 6.2.1 that allows for an integer overflow and subsequent buffer overflow when processing crafted input. This vulnerability affects 32-bit platforms and can lead to a segmentation fault.
Vulnerability Detail
The vulnerability in GMP arises from an integer overflow in the mpz/inp_raw.c file, which results in a buffer overflow. An attacker can exploit this vulnerability by providing specially crafted input to the library, causing it to perform arithmetic operations beyond the bounds of allocated memory. This can lead to a segmentation fault and potentially allow the attacker to execute arbitrary code or crash the application. The impact of this vulnerability is particularly severe on 32-bit platforms.
How To Fix
Minimum fixed version
6.2.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade gmpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of GMP to mitigate the risk of exploitation.
Conclusion
The integer overflow and buffer overflow vulnerability in GMP can have severe consequences on 32-bit platforms. It is crucial to update to the fixed version of GMP (6.2.1-r1 or later) to mitigate the risk of exploitation. Regularly checking for updates and applying patches is essential for maintaining the security of the software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for gmp →
FAQ
GMP is the GNU Multiple Precision Arithmetic Library, a widely used open-source library for performing arithmetic operations on large integers and floating-point numbers.
This vulnerability can lead to a segmentation fault on 32-bit platforms. It may also allow an attacker to execute arbitrary code or crash the application.
To fix this vulnerability, update your GMP installation to version 6.2.1-r1 or later.
No, there is no known workaround. Updating to the fixed version of GMP is the recommended solution.
You can find more information about this vulnerability in the CVE-2021-43618 JSON report: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43618.json
Related vulnerabilities
Recent vulnerabilities recorded for gmp.
