Skip to content
Fencer Vulns
medium 5.5

CVE-2021-33910 json

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdu…

published 2021-07-20 5 y ago modified 2026-10-14 26 d ago also EUVD-2021-20582

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.8%
EPSS 8.8% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • systemd Debian 14, Debian 13, Debian 12 247.3-6

debian advisories DEBIAN-CVE-2021-33910

  • systemd Ubuntu 18.04 LTS 237-3ubuntu10.49
  • systemd Ubuntu 20.04 LTS 245.4-4ubuntu3.10
  • systemd Ubuntu Pro 16.04 LTS 229-4ubuntu21.31+esm1

ubuntu advisories UBUNTU-CVE-2021-33910

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.4.7-20210715.1.el8_4
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.7-20210715.1.el8_4
  • systemd RHEL 8 239-45.el8_4.2
  • systemd-pam RHEL 8 239-45.el8_4.2
  • systemd-libs RHEL 8 239-45.el8_4.2
  • systemd-udev RHEL 8 239-45.el8_4.2
  • systemd-tests RHEL 8 239-45.el8_4.2
  • systemd-container RHEL 8 239-45.el8_4.2

red hat advisories RHSA-2021:2736RHSA-2021:2721RHSA-2021:2724RHSA-2021:2717

  • systemd SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 228-157.33.1
  • systemd SLE Module for Basesystem 15 SP2 234-24.93.1
  • systemd SLE Module for Basesystem 15 SP3 246.15-7.11.1
  • systemd SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4-LTSS +8 more 228-150.98.1
  • systemd SLE Module for Basesystem 15 SP3 246.13-7.8.1
  • systemd SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 228-157.30.1
  • systemd SLE Module for Basesystem 15 SP2 234-24.90.1

suse advisories SUSE-SU-2021:3611-1SUSE-SU-2021:3348-1SUSE-SU-2021:2809-1SUSE-SU-2021:2423-1SUSE-SU-2021:2410-1SUSE-SU-2021:2405-1

  • systemd openSUSE Tumbleweed 249.4-2.2
  • systemd openSUSE Leap 15.2 234-lp152.31.34.1
  • systemd-mini openSUSE Leap 15.2 234-lp152.31.34.1
  • systemd openSUSE Leap 15.3 234-24.93.1
  • systemd openSUSE Leap 15.3 246.15-7.11.1
  • systemd openSUSE Leap 15.2 234-lp152.31.31.1
  • systemd-mini openSUSE Leap 15.2 234-lp152.31.31.1
  • systemd openSUSE Leap 15.3 246.13-7.8.1

opensuse advisories openSUSE-SU-2024:11420-1openSUSE-SU-2021:1370-1openSUSE-SU-2021:3348-1openSUSE-SU-2021:2809-1openSUSE-SU-2021:1082-1openSUSE-SU-2021:2410-1

  • systemd Rocky Linux 8 239-45.el8_4.2

rocky linux advisories RLSA-2021:2717

  • systemd Arch Linux 249.1-1

arch linux advisories AVG-2179

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-33910 updated cvss 5.5

systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash

  • Red Hat Enterprise Linux BaseOS (v. 8) systemd 239-45.el8_4.2, systemd-pam 239-45.el8_4.2, systemd-libs 239-45.el8_4.2, systemd-udev 239-45.el8_4.2, systemd-tests 239-45.el8_4.2, systemd-container 239-45.el8_4.2, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2717
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) systemd 239-18.el8_1.8, systemd-pam 239-18.el8_1.8, systemd-libs 239-18.el8_1.8, systemd-udev 239-18.el8_1.8, systemd-tests 239-18.el8_1.8, systemd-container 239-18.el8_1.8, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2724
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) systemd 239-31.el8_2.4, systemd-pam 239-31.el8_2.4, systemd-libs 239-31.el8_2.4, systemd-udev 239-31.el8_2.4, systemd-tests 239-31.el8_2.4, systemd-container 239-31.el8_2.4, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2721
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.7-20210715.1.el8_4, redhat-virtualization-host-image-update 4.4.7-20210715.1.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2736
  • Red Hat Enterprise Linux 7 systemd, libgudev1, systemd-libs, systemd-sysv, systemd-python, systemd-networkd, +2 more Red Hat Enterprise Linux 9 systemd, systemd-pam, systemd-libs, systemd-oomd, systemd-udev, systemd-ukify, +6 more Red Hat Virtualization 4 Hypervisor for RHEL 8 vhostmd 1.1-5.el8, vm-dump-metrics 1.1-5.el8, fcoe-utils 1.0.33-3.git848bcc6.el8 Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) imgbased 1.2.21-1.el8ev, python3-imgbased 1.2.21-1.el8ev, scap-security-guide 0.1.54-2.el8ev, scap-security-guide-rhv 0.1.54-2.el8ev, redhat-release-virtualization-host 4.4.7-3.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.7-3.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 5.5

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-167-09 updated cvss 5.5

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

8.79% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • openwall.com https://www.openwall.com/lists/oss-security/2021/07/20/2 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.