CVE-2021-4091: Double Free
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
Other sources
When a worker thread processes a persisten search, it duplicates the private pblock and spawns a dedicated thread to handle the persistent search. It will later free that cloned pblock.
However, both pblock (original an cloned) refer to the same virtual attribute context, resulting in the context be freed once per pblock instance.
389-ds-base-1.3.6.4 and newer (including 1.4 and 2.0) are expected to be vulnerable to this flaw.
The flaw has been introduced by the following commit : https://github.com/389ds/389-ds-base/commit/74c666b83e3e1789c2ef3f7935c327bd7555193e
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4091?
The severity of CVE-2021-4091 is high with a severity value of 7.5.
What is the affected software for CVE-2021-4091?
The affected software for CVE-2021-4091 includes Port389 389-ds-base version up to exclusive 1.3.10.2, Redhat Enterprise Linux Desktop 7, Redhat Enterprise Linux For Ibm Z Systems 7.0, Redhat Enterprise Linux For Power Big Endian 7.0, Redhat Enterprise Linux For Power Little Endian 7.0, Redhat Enterprise Linux For Scientific Computing 7.0, Redhat Enterprise Linux Server 7.0, and Redhat Enterprise Linux Workstation 7.0.
How can an attacker exploit CVE-2021-4091?
An attacker can exploit CVE-2021-4091 by sending a series of search requests to the server, forcing it to behave unexpectedly and crash.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-4091?
The Common Weakness Enumeration (CWE) ID for CVE-2021-4091 is CWE-415.
Where can I find more information about CVE-2021-4091?
You can find more information about CVE-2021-4091 at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2030307) and [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html).