CVE-2021-32613: fedoraproject fedora Use After Free
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2021-32613
Published 14-05-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-32613 is a medium (CVSS 5.5) Use After Free vulnerability in fedoraproject fedora. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 66.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
1.17%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 14-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.17% on 19-09-2026
19-09-202619-10-2026
EPSS score1.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRadare2
Maturity: poc
Weaknesses
CWE · root cause- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-415Double FreeThe product calls free() twice on the same memory address.
Affected systems
Fedoraproject1 product
- fedoraEOL33 | 34
Radare1 product
- radare2≤ 5.3.0
Ubuntu1 product
- radare2All versions (No fix recorded)
3 vendors · 3 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=1959939X Refsource MISCREPORTIssue TrackingPatchThird Party Advisory
- github.com/radareorg/radare2/issues/18679X Refsource MISCREPORTExploitIssue TrackingPatchThird Party Advisory
- github.com/radareorg/radare2/issues/18667X Refsource MISCExploitIssue TrackingPatchThird Party Advisory
- github.com/radareorg/radare2/commit/a07dedb804a82bc01c07072861942dd80c6b6d62X Refsource MISCPatchThird Party Advisory
- github.com/radareorg/radare2/issues/18666X Refsource MISCExploitIssue TrackingPatchThird Party Advisory
- github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05X Refsource MISCPatchThird Party Advisory