CVE-2021-3561 – CVE-2021-3561 is an out-of-bounds memory access... (How to Fix)

📋 TL;DR

CVE-2021-3561 is an out-of-bounds memory access vulnerability in fig2dev's read_objects() function that allows attackers to crash the application or potentially cause memory corruption through crafted input. This affects systems using fig2dev version 3.2.8a to convert FIG format files. The primary risks are denial of service and potential integrity compromise.

💻 Affected Systems

Products:

fig2dev

Versions: Version 3.2.8a and earlier

Operating Systems: Linux, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability triggers when processing malicious FIG files through the read_objects() function.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Memory corruption leading to arbitrary code execution, potentially allowing full system compromise if fig2dev runs with elevated privileges.

🟠

Likely Case

Application crash causing denial of service during FIG file conversion processes.

🟢

If Mitigated

Limited impact with proper input validation and sandboxing, resulting only in application termination.

🌐 Internet-Facing: LOW - fig2dev is typically not exposed to internet-facing services.

🏢 Internal Only: MEDIUM - Risk exists for internal systems processing untrusted FIG files, particularly in automated conversion workflows.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Proof-of-concept available in bug reports; exploitation requires feeding malicious FIG file to vulnerable fig2dev instance.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in commit 6827c09d2d6491cb2ae3ac7196439ff3aa791fd9 and later versions

Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1955675

Restart Required: No

Instructions:

1. Update fig2dev package through system package manager
2. For source installations: pull latest code from SourceForge repository and rebuild
3. Verify version is post-fix commit

🔧 Temporary Workarounds

Input validation and sanitization

all

Implement strict validation of FIG files before processing with fig2dev

Sandbox execution

linux

Run fig2dev in restricted environment with limited privileges

sudo chroot /path/to/jail /usr/bin/fig2dev

🧯 If You Can't Patch

Restrict fig2dev usage to trusted users only
Implement network segmentation to isolate systems running vulnerable fig2dev versions

🔍 How to Verify

Check if Vulnerable:

Check fig2dev version: fig2dev -v 2>&1 | grep -i version

Check Version:

fig2dev -v 2>&1 | head -1

Verify Fix Applied:

Verify version is newer than 3.2.8a or check for fix commit 6827c09d2d6491cb2ae3ac7196439ff3aa791fd9 in source

📡 Detection & Monitoring

Log Indicators:

Segmentation fault errors in system logs
Abnormal termination of fig2dev processes

Network Indicators:

Unusual file transfer activity to systems running fig2dev

SIEM Query:

process.name="fig2dev" AND (event.action="segmentation_fault" OR event.action="crash")

📊 Metadata

CVE ID: CVE-2021-3561

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CWE: CWE-119

Published: May 26, 2021

Last Updated: November 21, 2024

🔗 References

https://bugzilla.redhat.com/show_bug.cgi?id=1955675 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C44WSY5KAQXC3Y2NMSVXXZS3M5U5U2E6/ Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKMOIQX6GULVSYXLYW5JQY6KJNTWV3E4/ Mailing List,Third Party Advisory
https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9/ Patch,Third Party Advisory
https://sourceforge.net/p/mcj/tickets/116/ Exploit,Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1955675 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C44WSY5KAQXC3Y2NMSVXXZS3M5U5U2E6/ Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKMOIQX6GULVSYXLYW5JQY6KJNTWV3E4/ Mailing List,Third Party Advisory
https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9/ Patch,Third Party Advisory
https://sourceforge.net/p/mcj/tickets/116/ Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-3561, you might also want to check these: