High severity · published Jan 20, 2023
CVE-2021-33641
When processing files, malloc stores the data of the current line
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BY
byacc ·
<1.9.20200330 and <2.0.20210808 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33641
Permissions Required
https://gitee.com/src-openeuler/byacc/commit/50225f48c6b53e9d7c936681a06682404cb8ec4d
More from byacc
5.5
CVE-2021-33642
When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function