Out-of-bounds write in gptfdisk (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-0308 |
| CWE-ID | CWE-787 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
gptfdisk (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Out-of-bounds write
EUVDB-ID: #VU49882
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-0308
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local authenticated user to execute arbitrary code.
In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158063095.
MitigationInstall update from vendor's website.
Vulnerable software versionsgptfdisk (Alpine package): 1.0.5-r0
CPE2.3 External linkshttps://git.alpinelinux.org/aports/commit/?id=17d343d5f3792fff23620e89b34950902e35207d
https://git.alpinelinux.org/aports/commit/?id=749b1792d8f894f648363e348f6638d0e959d6af
https://git.alpinelinux.org/aports/commit/?id=dd685a4f3afcf809387bc210d3f13395d03b19cd
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
