CVE-2021-27135
📋 TL;DR
CVE-2021-27135 is a critical vulnerability in xterm terminal emulator that allows remote attackers to execute arbitrary code or cause denial of service via specially crafted UTF-8 combining character sequences. This affects systems running vulnerable versions of xterm before Patch #366. Attackers can exploit this by sending malicious sequences to the terminal.
💻 Affected Systems
- xterm terminal emulator
📦 What is this software?
Fedora by Fedoraproject
Xterm by Invisible Island
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Denial of service through segmentation faults causing terminal crashes and disrupting user sessions.
If Mitigated
Limited impact with proper network segmentation and terminal access controls preventing malicious input delivery.
🎯 Exploit Status
Exploitation requires ability to send input to the vulnerable xterm instance, typically through user interaction or automated terminal input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patch #366 or later
Vendor Advisory: https://invisible-island.net/xterm/xterm.log.html
Restart Required: Yes
Instructions:
1. Update xterm to version with Patch #366 or later. 2. For RedHat/CentOS: yum update xterm. 3. For Debian/Ubuntu: apt update && apt install xterm. 4. Restart any active xterm sessions.
🔧 Temporary Workarounds
Disable UTF-8 combining characters
linuxConfigure xterm to disable UTF-8 combining character processing
Add 'XTerm*allowCombineChars: false' to ~/.Xresources or XTerm configuration
Use alternative terminal
linuxTemporarily switch to non-vulnerable terminal emulators
Use gnome-terminal, konsole, or other terminals not based on vulnerable xterm code
🧯 If You Can't Patch
- Restrict terminal access to trusted users only
- Implement network segmentation to limit exposure of terminal services
🔍 How to Verify
Check if Vulnerable:
Check xterm version: xterm -version | grep 'Patch #' and verify it's before #366Check Version:
xterm -versionVerify Fix Applied:
Confirm xterm version shows Patch #366 or higher: xterm -version📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in system logs
- Unexpected xterm process crashes
- Abnormal terminal session terminations
Network Indicators:
- Unusual UTF-8 character sequences in terminal traffic
- Multiple failed terminal connections
SIEM Query:
process.name:"xterm" AND event.action:"segmentation fault" OR process.exit_code:139🔗 References
- http://seclists.org/fulldisclosure/2021/May/52
- http://www.openwall.com/lists/oss-security/2021/02/10/7
- https://access.redhat.com/security/cve/CVE-2021-27135
- https://bugzilla.redhat.com/show_bug.cgi?id=1927559
- https://bugzilla.suse.com/show_bug.cgi?id=1182091
- https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c
- https://invisible-island.net/xterm/xterm.log.html
- https://lists.debian.org/debian-lts-announce/2021/02/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/
- https://news.ycombinator.com/item?id=26524650
- https://security.gentoo.org/glsa/202208-22
- https://www.openwall.com/lists/oss-security/2021/02/09/7
- https://www.openwall.com/lists/oss-security/2021/02/09/9
- http://seclists.org/fulldisclosure/2021/May/52
- http://www.openwall.com/lists/oss-security/2021/02/10/7
- https://access.redhat.com/security/cve/CVE-2021-27135
- https://bugzilla.redhat.com/show_bug.cgi?id=1927559
- https://bugzilla.suse.com/show_bug.cgi?id=1182091
- https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c
- https://invisible-island.net/xterm/xterm.log.html
- https://lists.debian.org/debian-lts-announce/2021/02/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/
- https://news.ycombinator.com/item?id=26524650
- https://security.gentoo.org/glsa/202208-22
- https://www.openwall.com/lists/oss-security/2021/02/09/7
- https://www.openwall.com/lists/oss-security/2021/02/09/9
