CVE-2021-33453
📋 TL;DR
CVE-2021-33453 is a use-after-free vulnerability in lrzip version 0.641 that occurs in the ucompthread() function. This vulnerability could allow attackers to execute arbitrary code or cause denial of service by exploiting memory corruption. Users and systems running the affected lrzip version are at risk.
💻 Affected Systems
- lrzip
📦 What is this software?
Long Range Zip by Long Range Zip Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service, potentially leading to data corruption in compression/decompression operations.
If Mitigated
Limited impact with proper sandboxing and privilege separation, potentially only causing application termination.
🎯 Exploit Status
Proof-of-concept code is publicly available in GitHub issues. Exploitation requires crafting a malicious archive file that triggers the use-after-free condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.642 and later
Vendor Advisory: https://github.com/ckolivas/lrzip/issues/199
Restart Required: No
Instructions:
1. Check current lrzip version: lrzip --version
2. Update using package manager: sudo apt update && sudo apt upgrade lrzip (Debian/Ubuntu) or sudo yum update lrzip (RHEL/CentOS)
3. Alternatively, compile from source: git clone https://github.com/ckolivas/lrzip && cd lrzip && make && sudo make install
🔧 Temporary Workarounds
Disable lrzip usage
linuxTemporarily disable or remove lrzip from systems until patched
sudo apt remove lrzip
sudo yum remove lrzip
Restrict file processing
allImplement input validation to reject suspicious archive files
🧯 If You Can't Patch
- Implement strict access controls to limit who can execute lrzip
- Deploy application sandboxing or containerization to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Run: lrzip --version | grep -q '0.641' && echo 'VULNERABLE' || echo 'SAFE'Check Version:
lrzip --versionVerify Fix Applied:
Run: lrzip --version | grep -q '0.64[2-9]\|0\.6[5-9]\|0\.[7-9]' && echo 'PATCHED' || echo 'STILL VULNERABLE'📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unexpected termination of lrzip processes
- Memory allocation errors in system logs
Network Indicators:
- Unusual archive file downloads to servers running lrzip
- Multiple failed compression/decompression attempts
SIEM Query:
process_name='lrzip' AND (event_type='crash' OR exit_code=139)