Memory Corruption in OpenRC
Summary
CVE-2021-42341: checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. Affects openrc across 3 version ranges.
< 0.43.3-r2
< 63db2d99e730547339d1bdd28e8437999c380cae
< bb8334104baf4d5a4a442a8647fb9204738f2204
Fixed in 0.43.3-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenRC is an init system and service manager for Unix-like operating systems. It is responsible for starting and stopping services during the boot process and managing system resources. OpenRC is widely used in the Alpine Linux distribution.
Vulnerability Detail
The vulnerability, identified as CVE-2021-42341, exists in the checkpath function of OpenRC before version 0.44.7. The function uses the output of strlen() to allocate strings without accounting for the '\0' byte at the end of the string. This oversight leads to memory corruption, potentially resulting in system instability or unauthorized access. The vulnerability was introduced in commit 63db2d99e730547339d1bdd28e8437999c380cae during the development of OpenRC 0.44.0.
How To Fix
Minimum fixed version
0.43.3-r2
This is the first release that contains the fix.
sudo apk add --upgrade openrcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The memory corruption vulnerability in OpenRC can have serious consequences for system stability and security. It is crucial to update to the fixed version (0.44.7 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openrc →
FAQ
OpenRC is an init system and service manager used in Unix-like operating systems, particularly Alpine Linux.
The vulnerability can lead to memory corruption, potentially causing system instability or unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time.
Yes, the fix for this vulnerability is available in OpenRC version 0.44.7 or later. It is recommended to update your system to the latest version.
You can find more information about this vulnerability in the CVE-2021-42341 JSON report at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-42341.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for openrc.
