crítica
CVE-2021-3520
lz4: memory corruption due to an integer overflow bug caused by memmove argument
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Julia, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Amazon (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Lz4_jll | 1.9.4+0 |
| Photon OS 2.0 | lz4 | 1.9.2-2.ph2 |
| Photon OS 3.0 | librdkafka, lz4, mysql | 1.5.0-1.ph3 y 2 más |
| Photon OS 4.0 | librdkafka, librdkafka-devel, lz4 y 4 más | 1.5.0-2.ph4 y 2 más |
| Photon OS 5.0 | librdkafka, librdkafka-devel, mysql y 2 más | 1.8.2-2.ph5 y 1 más |
| alma 8 | lz4, lz4-devel, lz4-libs | 1.8.3-3.el8_4 |
| alpine 3.12 | lz4 | 1.9.2-r1 |
| alpine 3.13 | lz4 | 1.9.2-r1 |
| alpine 3.14 | lz4 | 1.9.3-r1 |
| alpine 3.15 | lz4 | 1.9.3-r1 |
| alpine 3.16 | lz4 | 1.9.3-r1 |
| alpine 3.17 | lz4 | 1.9.3-r1 |
Mostrar las 73 entradas de 41 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Lz4_jll | 1.9.4+0 |
| Photon OS 2.0 | lz4 | 1.9.2-2.ph2 |
| Photon OS 3.0 | librdkafka | 1.5.0-1.ph3 |
| Photon OS 3.0 | lz4 | 1.9.3-2.ph3 |
| Photon OS 3.0 | mysql | 8.0.34-1.ph3 |
| Photon OS 4.0 | librdkafka | 1.5.0-2.ph4 |
| Photon OS 4.0 | librdkafka-devel | 1.5.0-2.ph4 |
| Photon OS 4.0 | lz4 | 1.9.2-2.ph4 |
| Photon OS 4.0 | lz4-devel | 1.9.2-2.ph4 |
| Photon OS 4.0 | mysql | 8.0.34-1.ph4 |
| Photon OS 4.0 | mysql-devel | 8.0.34-1.ph4 |
| Photon OS 4.0 | mysql-icu-data-files | 8.0.34-1.ph4 |
| Photon OS 5.0 | librdkafka | 1.8.2-2.ph5 |
| Photon OS 5.0 | librdkafka-devel | 1.8.2-2.ph5 |
| Photon OS 5.0 | mysql | 8.0.34-1.ph5 |
| Photon OS 5.0 | mysql-devel | 8.0.34-1.ph5 |
| Photon OS 5.0 | mysql-icu-data-files | 8.0.34-1.ph5 |
| alma 8 | lz4 | 1.8.3-3.el8_4 |
| alma 8 | lz4-devel | 1.8.3-3.el8_4 |
| alma 8 | lz4-libs | 1.8.3-3.el8_4 |
| alpine 3.12 | lz4 | 1.9.2-r1 |
| alpine 3.13 | lz4 | 1.9.2-r1 |
| alpine 3.14 | lz4 | 1.9.3-r1 |
| alpine 3.15 | lz4 | 1.9.3-r1 |
| alpine 3.16 | lz4 | 1.9.3-r1 |
| alpine 3.17 | lz4 | 1.9.3-r1 |
| alpine 3.18 | lz4 | 1.9.3-r1 |
| alpine 3.19 | lz4 | 1.9.3-r1 |
| alpine 3.20 | lz4 | 1.9.3-r1 |
| alpine 3.21 | lz4 | 1.9.3-r1 |
| alpine 3.22 | lz4 | 1.9.3-r1 |
| alpine 3.23 | lz4 | 1.9.3-r1 |
| alpine 3.24 | lz4 | 1.9.3-r1 |
| alpine edge | lz4 | 1.9.3-r1 |
| amazon linux 2022 | lz4 | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2022 | lz4-debuginfo | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2022 | lz4-debugsource | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2022 | lz4-devel | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2022 | lz4-libs | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2022 | lz4-libs-debuginfo | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2022 | lz4-static | 1.9.4-1.amzn2022.0.1 |
| amazon linux 2023 | lz4 | 1.9.4-1.amzn2023.0.2 |
| amazon linux 2023 | lz4-debuginfo | 1.9.4-1.amzn2023.0.2 |
| amazon linux 2023 | lz4-debugsource | 1.9.4-1.amzn2023.0.2 |
| amazon linux 2023 | lz4-devel | 1.9.4-1.amzn2023.0.2 |
| amazon linux 2023 | lz4-libs | 1.9.4-1.amzn2023.0.2 |
| amazon linux 2023 | lz4-libs-debuginfo | 1.9.4-1.amzn2023.0.2 |
| amazon linux 2023 | lz4-static | 1.9.4-1.amzn2023.0.2 |
| conan::GitLab Advisory Database Community | lz4 | 1.9.2 |
| debian 10 | lz4 | 1.8.3-1+deb10u1 |
| debian 11 | lz4 | 1.9.3-2 |
| debian 12 | lz4 | 1.9.3-2 |
| debian 13 | lz4 | 1.9.3-2 |
| debian 14 | lz4 | 1.9.3-2 |
| debian 9 | lz4 | 0.0~r131-2+deb9u1 |
| echo | lz4 | 1.9.3-2 |
| Oracle Linux 8 | lz4 | 1.8.3-3.el8_4 |
| Oracle Linux 8 | lz4-devel | 1.8.3-3.el8_4 |
| Oracle Linux 8 | lz4-libs | 1.8.3-3.el8_4 |
| Red Hat | lz4 | sin corrección indicada |
| Red Hat | lz4-devel | sin corrección indicada |
| Red Hat | lz4-static | sin corrección indicada |
| rocky 8 | lz4 | 1.8.3-3.el8_4 |
| rocky 8 | lz4-devel | 1.8.3-3.el8_4 |
| rocky 8 | lz4-libs | 1.8.3-3.el8_4 |
| ubuntu 14.04-ESM | lz4 | 0.0~r114-2ubuntu1+esm2 |
| ubuntu 16.04-ESM | lz4 | 0.0~r131-2ubuntu2+esm1 |
| ubuntu 18.04 | lz4 | 0.0~r131-2ubuntu3.1 |
| ubuntu 18.04-ESM | lz4 | 0.0~r131-2ubuntu3.1 |
| ubuntu 20.04 | lz4 | 1.9.2-2ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | lz4 | 1.9.2-2ubuntu0.20.04.1 |
| ubuntu 20.10 | lz4 | 1.9.2-2ubuntu0.20.10.1 |
| ubuntu 21.04 | lz4 | 1.9.3-1ubuntu0.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2021-3520
- https://bugzilla.redhat.com/show_bug.cgi?id=1954559
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3520
- https://errata.almalinux.org/8/ALSA-2021-2575.html
- https://errata.rockylinux.org/RLSA-2021:2575
- https://github.com/lz4/lz4/pull/972
- https://linux.oracle.com/cve/CVE-2021-3520.html
Las 17 referencias
- https://linux.oracle.com/errata/ELSA-2021-2575.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-3520
- https://security.netapp.com/advisory/ntap-20211104-0005/
- https://ubuntu.com/security/notices/USN-4968-1
- https://ubuntu.com/security/notices/USN-4968-2
- https://www.cve.org/CVERecord?id=CVE-2021-3520
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html