Skip to content
Fencer Vulns
high 8.3

CVE-2021-42574 in the critical feed json

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.

published 2021-11-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-29541

cvss
8.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
12.9%
EPSS 12.9% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Patch / fix

  • unicode unicode 14.0.0
  • rustc Debian 14, Debian 13, Debian 12 1.57.0+dfsg1-1

debian advisories DEBIAN-CVE-2021-42574

  • rustc Ubuntu 20.04 LTS 1.57.0+dfsg1+llvm-0ubuntu1~20.04.1
  • rustc Ubuntu 22.04 LTS 1.57.0+dfsg1+llvm-0ubuntu2

ubuntu advisories UBUNTU-CVE-2021-42574

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • devtoolset-10-binutils RHEL 3 SOFTWARE_COLLECTIONS 2.35-5.el7.3
  • devtoolset-10-annobin RHEL 3 SOFTWARE_COLLECTIONS 9.23-4.el7.1
  • devtoolset-10-annobin-annocheck RHEL 3 SOFTWARE_COLLECTIONS 9.23-4.el7.1
  • rls RHEL 8 1.54.0-3.module+el8.5.0+13074+d655d86c
  • rust RHEL 8 1.54.0-3.module+el8.5.0+13074+d655d86c
  • cargo RHEL 8 1.54.0-3.module+el8.5.0+13074+d655d86c
  • clippy RHEL 8 1.54.0-3.module+el8.5.0+13074+d655d86c
  • rustfmt RHEL 8 1.54.0-3.module+el8.5.0+13074+d655d86c

red hat advisories RHSA-2021:4589RHSA-2021:4723RHSA-2021:4724RHSA-2021:4590RHSA-2021:4586RHSA-2021:4600

  • rust1.56 openSUSE Tumbleweed 1.56.1-1.1

opensuse advisories openSUSE-SU-2024:11650-1

  • lld AlmaLinux 8 12.0.1-1.module_el8.4.0+2600+cefb5d4c
  • lldb AlmaLinux 8 12.0.1-1.module_el8.4.0+2600+cefb5d4c
  • llvm AlmaLinux 8 12.0.1-2.module_el8.4.0+2600+cefb5d4c
  • clang AlmaLinux 8 12.0.1-4.module_el8.4.0+2600+cefb5d4c
  • libomp AlmaLinux 8 12.0.1-1.module_el8.4.0+2600+cefb5d4c
  • lld-libs AlmaLinux 8 12.0.1-1.module_el8.4.0+2600+cefb5d4c
  • lld-test AlmaLinux 8 12.0.1-1.module_el8.4.0+2600+cefb5d4c
  • llvm-libs AlmaLinux 8 12.0.1-2.module_el8.4.0+2600+cefb5d4c

almalinux advisories ALSA-2021:4743ALSA-2021:4649ALSA-2021:4594ALSA-2021:4593ALSA-2021:4592ALSA-2021:4591

  • lld Rocky Linux 8 12.0.1-1.module+el8.5.0+692+8756646f
  • lldb Rocky Linux 8 12.0.1-1.module+el8.5.0+692+8756646f
  • llvm Rocky Linux 8 12.0.1-2.module+el8.5.0+692+8756646f
  • clang Rocky Linux 8 12.0.1-4.module+el8.5.0+715+58f51d49
  • libomp Rocky Linux 8 12.0.1-1.module+el8.5.0+692+8756646f
  • python-lit Rocky Linux 8 12.0.1-1.module+el8.5.0+692+8756646f
  • compiler-rt Rocky Linux 8 12.0.1-1.module+el8.5.0+692+8756646f
  • llvm-toolset Rocky Linux 8 12.0.1-1.module+el8.5.0+692+8756646f

rocky linux advisories RLSA-2021:4743RLSA-2021:4649RLSA-2021:4595RLSA-2021:4594RLSA-2021:4593RLSA-2021:4592

  • rust Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 1.56.1-r0
  • chromium-rust Alpine 3.24 1.56.1-r0

alpine advisories ALPINE-CVE-2021-42574

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rust Arch Linux 1:1.56.1-1

arch linux advisories AVG-2506

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-42574 updated cvss 8.5

environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks

  • Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, libgcc, libitm, +15 more Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +11 more
    affected: workaround, no fix planned “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.”
  • Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more
    affected: workaround, no fix available “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.”
  • Red Hat CodeReady Linux Builder (v. 8) cpp-debuginfo 8.5.0-4.el8_5, gcc-debuginfo 8.5.0-4.el8_5, gcc-debugsource 8.5.0-4.el8_5, gcc-plugin-devel 8.5.0-4.el8_5, libgcc-debuginfo 8.5.0-4.el8_5, libitm-debuginfo 8.5.0-4.el8_5, +25 more
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4587
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rust-toolset-1.54-rls 1.54.0-4.el7_9, rust-toolset-1.54-rust 1.54.0-4.el7_9, rust-toolset-1.54-cargo 1.54.0-4.el7_9, rust-toolset-1.54-clippy 1.54.0-4.el7_9, rust-toolset-1.54-rustfmt 1.54.0-4.el7_9, rust-toolset-1.54-rust-gdb 1.54.0-4.el7_9, +4 more
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4694
  • Red Hat Enterprise Linux AppStream (v. 8) cpp 8.5.0-4.el8_5, gcc 8.5.0-4.el8_5, gcc-c++ 8.5.0-4.el8_5, annobin 9.72-1.el8_5.2, libasan6 10.3.1-1.2.el8_5, libasan6 11.2.1-1.2.el8_5, +53 more
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4593
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) annobin 8.78-1.el8_1.1
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4599
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) annobin 8.90-1.el8_2.1
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4600
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) annobin 9.50-1.el8_4.1, annobin-annocheck 9.50-1.el8_4.1, gcc-toolset-10-annobin 9.29-1.el8_4.1, gcc-toolset-10-binutils 2.35-8.el8_4.5
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4598
show 18 more
  • Red Hat Enterprise Linux BaseOS (v. 8) gcc 8.5.0-4.el8_5, libgcc 8.5.0-4.el8_5, libitm 8.5.0-4.el8_5, libasan 8.5.0-4.el8_5, libgomp 8.5.0-4.el8_5, liblsan 8.5.0-4.el8_5, +8 more
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4595
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) binutils 2.30-58.el8_1.3
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4602
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) binutils 2.30-73.el8_2.1
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4601
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4) binutils 2.30-93.el8_4.2
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4596
  • Red Hat Enterprise Linux Client (v. 7) binutils 2.27-44.base.el7_9.1 Red Hat Enterprise Linux Client Optional (v. 7) binutils-devel 2.27-44.base.el7_9.1, binutils-debuginfo 2.27-44.base.el7_9.1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) binutils-devel 2.27-44.base.el7_9.1, binutils-debuginfo 2.27-44.base.el7_9.1 Red Hat Enterprise Linux Server (v. 7) binutils 2.27-44.base.el7_9.1
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4033
  • Red Hat Enterprise Linux Server AUS (v. 7.2) binutils 2.23.52.0.1-55.el7_2.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4038
  • Red Hat Enterprise Linux Server AUS (v. 7.3) binutils 2.25.1-22.base.el7_3.3
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4037
  • Red Hat Enterprise Linux Server AUS (v. 7.4) binutils 2.25.1-32.base.el7_4.5
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4036
  • Red Hat Enterprise Linux Server AUS (v. 7.6) binutils 2.27-34.base.el7_6.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4035
  • Red Hat Enterprise Linux Server AUS (v. 7.7) binutils 2.27-41.base.el7_7.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4034
  • Red Hat Enterprise Linux Server E4S (v. 7.6) binutils 2.27-34.base.el7_6.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4035
  • Red Hat Enterprise Linux Server E4S (v. 7.7) binutils 2.27-41.base.el7_7.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4034
  • Red Hat Enterprise Linux Server TUS (v. 7.6) binutils 2.27-34.base.el7_6.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4035
  • Red Hat Enterprise Linux Server TUS (v. 7.7) binutils 2.27-41.base.el7_7.4
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4034
  • Red Hat Enterprise Linux Workstation (v. 7) binutils 2.27-44.base.el7_9.1
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4033
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) liblsan 10.2.1-11.2.el7, libtsan 10.2.1-11.2.el7, libasan6 10.2.1-11.2.el7, libubsan1 10.2.1-11.2.el7, devtoolset-10-gcc 10.2.1-11.2.el7, devtoolset-10-annobin 9.23-4.el7.1, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) liblsan 11.2.1-1.2.el7, libtsan 11.2.1-1.2.el7, libasan6 11.2.1-1.2.el7, liblsan 10.2.1-11.2.el7, libtsan 10.2.1-11.2.el7, libasan6 10.2.1-11.2.el7, +19 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) liblsan 10.2.1-11.2.el7, libtsan 10.2.1-11.2.el7, libasan6 10.2.1-11.2.el7, libubsan1 10.2.1-11.2.el7, devtoolset-10-gcc 10.2.1-11.2.el7, devtoolset-10-annobin 9.23-4.el7.1, +6 more
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4724
  • Red Hat Software Collections for RHEL Workstation(v. 7) liblsan 11.2.1-1.2.el7, libtsan 11.2.1-1.2.el7, libasan6 11.2.1-1.2.el7, libubsan1 11.2.1-1.2.el7, devtoolset-11-gcc 11.2.1-1.2.el7, devtoolset-11-annobin 9.82-1.el7.1, +7 more Red Hat Software Collections for RHEL(v. 7) liblsan 11.2.1-1.2.el7, libtsan 11.2.1-1.2.el7, libasan6 11.2.1-1.2.el7, libubsan1 11.2.1-1.2.el7, devtoolset-11-gcc 11.2.1-1.2.el7, devtoolset-11-annobin 9.82-1.el7.1, +7 more
    fixed: vendor fix “This issue can be mitigated by ensuring code commits get a proper review. All new commits can also be scanned for the presence of BiDi characters before accepting the commit.” RHSA-2021:4729
  • Red Hat Enterprise Linux 9 cpp, gcc, rust, cargo, clang, clippy, +45 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

12.88% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • trojansource.codes https://trojansource.codes referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2021/11/01/1 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2021/11/01/4 referenced PoC, tagged "exploit" by a source, unverified
  • scyon.nl https://www.scyon.nl/post/trojans-in-your-source-code referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.