CVE-2021-3345
📋 TL;DR
This vulnerability is a heap-based buffer overflow in Libgcrypt's _gcry_md_block_write function when processing large count values during digest finalization. It affects systems using Libgcrypt 1.9.0 for cryptographic operations, potentially allowing attackers to execute arbitrary code or cause denial of service.
💻 Affected Systems
- Libgcrypt
- GnuPG
- Applications using Libgcrypt library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service through application crashes or system instability when processing malicious inputs.
If Mitigated
Limited impact if systems are patched, use proper input validation, or have exploit mitigations like ASLR and stack canaries.
🎯 Exploit Status
Exploitation requires control over the count parameter in digest finalization, which may require specific application conditions. No public exploits have been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Libgcrypt 1.9.1 or later
Vendor Advisory: https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html
Restart Required: Yes
Instructions:
1. Check current Libgcrypt version with 'libgcrypt-config --version'. 2. Download Libgcrypt 1.9.1+ from https://gnupg.org/download/. 3. Compile and install following the INSTALL instructions. 4. Restart any services using Libgcrypt.
🔧 Temporary Workarounds
Downgrade to Libgcrypt 1.8.x
linuxRevert to a non-vulnerable version if upgrading to 1.9.1 is not immediately possible.
apt-get install libgcrypt20=1.8.5-5ubuntu1 (example for Ubuntu)
yum downgrade libgcrypt-1.8.5 (example for RHEL)
🧯 If You Can't Patch
- Implement strict input validation in applications using Libgcrypt to prevent large count values.
- Use exploit mitigations like ASLR, stack canaries, and memory protection mechanisms.
🔍 How to Verify
Check if Vulnerable:
Run 'libgcrypt-config --version' and check if output is exactly '1.9.0'.Check Version:
libgcrypt-config --versionVerify Fix Applied:
After patching, run 'libgcrypt-config --version' and confirm version is 1.9.1 or higher.📡 Detection & Monitoring
Log Indicators:
- Application crashes or segmentation faults in processes using Libgcrypt
- Unexpected memory access errors in system logs
Network Indicators:
- Unusual network traffic to services using cryptographic functions
- Anomalous payload sizes in cryptographic operations
SIEM Query:
source=*log* AND ("segmentation fault" OR "buffer overflow") AND process="*libgcrypt*"🔗 References
- https://bugs.gentoo.org/show_bug.cgi?id=767814
- https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=512c0c75276949f13b6373b5c04f7065af750b08
- https://gnupg.org
- https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html
- https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000456.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://bugs.gentoo.org/show_bug.cgi?id=767814
- https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=512c0c75276949f13b6373b5c04f7065af750b08
- https://gnupg.org
- https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html
- https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000456.html
- https://www.oracle.com//security-alerts/cpujul2021.html
