Skip to main content

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2021-37404

High
9.8/10

Summary

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. This issue affects versions 2.9.0 through 2.10.1, 3.0.0 through 3.2.2, and 3.3.0 through 3.3.1. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2, or higher.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

Advisory Timeline

  • Published