Heap buffer overflow in libhdfs native library

CVE-2021-37404 is a heap buffer overflow vulnerability in the native code of Apache Hadoop's libhdfs library. The root cause is the lack of validation on user-provided file paths when they are opened by the library, leading to a write beyond the allocated heap buffer [1].

An attacker can exploit this vulnerability by supplying a specially crafted file path to an application that uses the libhdfs library. No authentication is required if the attacker can invoke file opening operations, potentially through the HDFS API or other interfaces that accept user input [1].

Successful exploitation could result in a denial of service due to application crash or memory corruption, or arbitrary code execution in the context of the Hadoop process. This could allow an attacker to compromise the system running Hadoop [1].

Apache has released fixes in Hadoop versions 2.10.2, 3.2.3, and 3.3.2. Users are advised to upgrade to these or later versions to mitigate the vulnerability [1].