High severity7.8NVD Advisory· Published Aug 8, 2021· Updated Jun 17, 2026
CVE-2021-38185
CVE-2021-38185
Description
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
36- GNU/cpiodescription
- osv-coords33 versionspkg:rpm/almalinux/cpiopkg:rpm/opensuse/cpio&distro=openSUSE%20Tumbleweedpkg:rpm/suse/cpio&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/cpio&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Micro%205.0pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/cpio&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/cpio&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/cpio&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/cpio&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/cpio&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/cpio&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/cpio&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/cpio&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
< 2.12-11.el8+ 32 more
- (no CPE)range: < 2.12-11.el8
- (no CPE)range: < 2.13-3.3
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.9-75.81.8.1
- (no CPE)range: < 2.9-75.81.8.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.12-3.9.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
- (no CPE)range: < 2.11-36.12.1
Patches
Vulnerability mechanics
References
4- git.savannah.gnu.org/cgit/cpio.git/commit/nvdPatchThird Party Advisory
- lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.htmlnvdExploitMailing ListVendor Advisory
- lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.htmlnvdExploitMailing ListVendor Advisory
- lists.debian.org/debian-lts-announce/2023/06/msg00007.htmlnvd
News mentions
0No linked articles in our index yet.