CVE-2021-4070: Off-by-one Error in v2fly/v2ray-core
Summary
CVE-2021-4070: Off-by-one Error in v2fly/v2ray-core in github.com/v2fly/v2ray-core. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- github.com/v2fly/v2ray-core/v4 · Go
- golang-v2ray-core · Debian:11
The same CVE-2021-4070 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The v2fly/v2ray-core package is a Go library that provides functionality for the V2Ray project. V2Ray is an open-source network proxy tool designed to protect user privacy and bypass internet censorship. The v2ray-core package is a critical component of the V2Ray project, responsible for handling network connections and routing traffic. This vulnerability affects versions 0 and above of the v2ray-core package.
Vulnerability Detail
The vulnerability identified as CVE-2021-4070 is an off-by-one error in the v2fly/v2ray-core package. This error occurs when the package attempts to access memory beyond the bounds of an array or buffer. An attacker could exploit this vulnerability by crafting a malicious input that triggers the off-by-one error, potentially leading to memory corruption, crashes, or even remote code execution. The impact of this vulnerability depends on the specific usage of the v2ray-core package in the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the v2ray-core package to the fixed version as soon as possible.
Conclusion
The off-by-one error in the v2fly/v2ray-core package can lead to memory corruption, crashes, or even remote code execution. It is crucial for developers to update their v2ray-core package to version 4.44.0 or above to mitigate this vulnerability.
See every vulnerability recorded for github.com/v2fly/v2ray-core →
FAQ
The v2fly/v2ray-core package is a Go library that provides functionality for the V2Ray project, a network proxy tool.
An off-by-one error occurs when a program attempts to access memory beyond the bounds of an array or buffer.
The consequences of this vulnerability can range from memory corruption and crashes to potential remote code execution, depending on the specific usage of the v2ray-core package.
You can update the v2ray-core package by running the following command: go get -u github.com/v2fly/v2ray-core/v4
There is no known workaround for this vulnerability. It is recommended to update the v2ray-core package to the fixed version.
