CVE-2021-30184
📋 TL;DR
CVE-2021-30184 is a buffer overflow vulnerability in GNU Chess 6.2.7 that allows attackers to execute arbitrary code by providing malicious PGN (Portable Game Notation) data. This affects users who process untrusted PGN files with vulnerable versions of GNU Chess, potentially leading to complete system compromise.
💻 Affected Systems
- GNU Chess
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Local privilege escalation or denial of service when processing malicious PGN files from untrusted sources.
If Mitigated
Limited impact if systems don't process untrusted PGN files or have proper input validation in place.
🎯 Exploit Status
Exploitation requires crafting malicious PGN files and getting them processed by vulnerable GNU Chess instances
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.8 or later
Vendor Advisory: https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00000.html
Restart Required: No
Instructions:
1. Update GNU Chess to version 6.2.8 or later using your distribution's package manager. 2. For Fedora/RHEL: 'sudo dnf update gnushogi'. 3. For Debian/Ubuntu: 'sudo apt update && sudo apt upgrade gnushogi'. 4. Verify installation with 'gnushogi --version'.
🔧 Temporary Workarounds
Restrict PGN file processing
allAvoid processing untrusted PGN files with GNU Chess
Remove vulnerable version
linuxUninstall GNU Chess 6.2.7 if not needed
sudo apt remove gnushogi
sudo dnf remove gnushogi
sudo yum remove gnushogi
🧯 If You Can't Patch
- Implement strict input validation for PGN files before processing
- Run GNU Chess in sandboxed/containerized environments with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check GNU Chess version: 'gnushogi --version' or 'rpm -q gnushogi' or 'dpkg -l | grep gnushogi'Check Version:
gnushogi --versionVerify Fix Applied:
Confirm version is 6.2.8 or later: 'gnushogi --version' should show 6.2.8+📡 Detection & Monitoring
Log Indicators:
- Segmentation faults or abnormal termination of GNU Chess processes
- Unexpected file operations in /tmp directory
Network Indicators:
- Unusual outbound connections from GNU Chess processes
SIEM Query:
process_name:"gnushogi" AND (event_type:"segfault" OR exit_code:139)🔗 References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QC74RWMDLSQGV6Z3ZABNTPABB33S4YNF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOGPLC77ZL2FACSOE5MWDS3YH3RBNQAQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXOTMUSBVUZNA3JMPG6BU37DQW2YOJWS/
- https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00000.html
- https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00001.html
- https://security.gentoo.org/glsa/202107-28
- https://lists.debian.org/debian-lts-announce/2025/01/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QC74RWMDLSQGV6Z3ZABNTPABB33S4YNF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOGPLC77ZL2FACSOE5MWDS3YH3RBNQAQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXOTMUSBVUZNA3JMPG6BU37DQW2YOJWS/
- https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00000.html
- https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00001.html
- https://security.gentoo.org/glsa/202107-28
