Integer Overflow and Buffer Overflow in GMP: CVE-2021-43618
Summary
ALPINE-CVE-2021-43618: GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. Affects gmp versions < 6.2.1-r1. Fixed in 6.2.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU Multiple Precision Arithmetic Library (GMP) is a widely used library for arbitrary-precision arithmetic, supporting integers, rational numbers, and floating-point numbers. It is known for its performance and efficiency in handling large numbers, making it essential for applications in cryptography, numerical analysis, and computational mathematics. However, a vulnerability has been identified in versions up to 6.2.1 that could lead to severe security issues.
Vulnerability Detail
The vulnerability arises from an integer overflow in the mpz/inp_raw.c file of GMP, which can be exploited through crafted input. This flaw can lead to a buffer overflow, resulting in a segmentation fault, particularly on 32-bit platforms. The implications of this vulnerability are significant, as it could allow an attacker to execute arbitrary code or crash the application, compromising the integrity and availability of the system.
How To Fix
Minimum fixed version
6.2.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade gmpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using the vulnerable functionality of the GMP library until you can apply the patch. However, this is not a long-term solution and updating to the patched version is strongly recommended.
Conclusion
The CVE-2021-43618 vulnerability in the GMP library poses a significant risk due to its potential for exploitation through integer and buffer overflows. It is crucial to update to the patched version 6.2.1-r1 to mitigate these risks and ensure the security of applications relying on this library.
See every vulnerability recorded for gmp →
FAQ
CVE-2021-43618 is a vulnerability in the GNU Multiple Precision Arithmetic Library (GMP) that can lead to an integer overflow and buffer overflow, potentially allowing for arbitrary code execution.
If your application uses GMP versions prior to 6.2.1-r1, it may be susceptible to crashes or exploitation through crafted inputs, leading to security breaches.
If an immediate update is not possible, refrain from using the vulnerable features of the GMP library as a temporary workaround until you can apply the patch.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2021-43618 is 7.5, indicating a high severity level that requires prompt attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for gmp.
