CVE-2021-4091
High · 7.5CVSS
7.5
EPSS
2.0%
Published
Feb 18, 2022
CISA due date
—
Cloudanix analysis
Next patch cycle
SSVC: Track
A bug in directory server software can let remote attackers crash the system with repeated lookup requests, interrupting logins and other services that depend on it.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Network Service
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Double-free in 389-ds-base virtual attributes context handling for persistent searches allows an unauthenticated remote attacker to trigger memory corruption that crashes the server process.
Why it matters to the business
Directory services become unavailable, blocking authentication, authorization, and lookups for any applications or users that rely on the server and causing operational downtime.
How an attack unfolds
An attacker repeatedly issues persistent search requests that exercise the vulnerable virtual-attributes code path, causing the server to free the same memory twice and terminate unexpectedly.
How to fix it
Upgrade 389-ds-base to a patched release that corrects the double-free; apply vendor updates for all listed Red Hat Enterprise Linux variants and restart the directory service.
How to confirm the fix worked
Confirm the installed 389-ds-base package version is newer than the vulnerable release, then test that repeated persistent searches no longer cause crashes.
Typical attack path
- Connect to the LDAP service
- Issue a series of persistent search requests
- Trigger double-free in virtual attributes handling
- Server process crashes and restarts or remains down
How to detect it
Inspect directory server logs for repeated persistent search operations immediately preceding unexpected process termination or core dumps; correlate with system crash reports.
- 389-ds-base process crash or core dump
- high volume of persistent search requests in access logs
- unexpected ds-slapd restarts
What your security team should do
- Prioritize patching all affected 389-ds-base instances
- Restrict unauthenticated LDAP access where feasible
- Enable process monitoring and automatic restarts for the directory server
- Review persistent search usage and disable unnecessary clients
The record
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | 389-ds-base | 0 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 |
| AlmaLinux:8 | 389-ds-base-devel | 0 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 |
| AlmaLinux:8 | 389-ds-base-legacy-tools | 0 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 |
| AlmaLinux:8 | 389-ds-base-libs | 0 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 |
| AlmaLinux:8 | 389-ds-base-snmp | 0 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 |
| AlmaLinux:8 | python3-lib389 | 0 | 1.4.3.23-14.module_el8.5.0+2628+c731dc97 |
| Debian:10 | 389-ds-base | 0 | 1.4.0.21-1+deb10u1 |
| Debian:11 | 389-ds-base | 0 | No fix |
| Debian:11 | 389-ds-base | 0 | 1.4.4.11-2+deb11u1 |
| Debian:12 | 389-ds-base | 0 | 2.0.15-1 |
| Debian:13 | 389-ds-base | 0 | 2.0.15-1 |
| Mageia:8 | 389-ds-base | 0 | 1.4.0.26-8.2.mga8 |
| Red Hat:directory_server:11.3::el8 | 389-ds-base | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-debuginfo | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-debugsource | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-devel | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-legacy-tools | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-libs | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-snmp | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | cockpit-389-ds | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:directory_server:11.3::el8 | python3-lib389 | 0 | 0:1.4.3.22-4.module+el8dsrv+13893+84b6c18c |
| Red Hat:enterprise_linux:7::client | 389-ds-base | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-debuginfo | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-devel | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-libs | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::client | 389-ds-base-snmp | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-debuginfo | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-devel | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-libs | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::computenode | 389-ds-base-snmp | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-debuginfo | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-devel | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-libs | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::server | 389-ds-base-snmp | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-debuginfo | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-devel | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-libs | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:7::workstation | 389-ds-base-snmp | 0 | 0:1.3.10.2-15.el7_9 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-debuginfo | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-debugsource | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-devel | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-legacy-tools | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-libs | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-snmp | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:enterprise_linux:8::appstream | python3-lib389 | 0 | 0:1.4.3.23-14.module+el8.5.0+14377+c731dc97 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-debuginfo | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-debugsource | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-devel | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-legacy-tools | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-legacy-tools-debuginfo | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-libs | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-libs-debuginfo | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-snmp | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | 389-ds-base-snmp-debuginfo | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Red Hat:rhel_eus:8.4::appstream | python3-lib389 | 0 | 0:1.4.3.16-20.module+el8.4.0+14552+b182c759 |
| Rocky Linux:8 | 389-ds-base | 0 | 0:1.4.3.23-14.module+el8.5.0+745+c5be6847 |
| SUSE:Enterprise Storage 6 | 389-ds | 0 | 1.4.2.16~git68.efa843752-150100.7.34.1 |
| SUSE:Enterprise Storage 7 | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | 389-ds | 0 | 1.4.2.16~git68.efa843752-150100.7.34.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | 389-ds | 0 | 1.4.2.16~git68.efa843752-150100.7.34.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | 389-ds | 0 | 1.4.0.31~git15.8b9843b0b-150000.4.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | 389-ds | 0 | 1.4.0.31~git15.8b9843b0b-150000.4.27.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP3 | 389-ds | 0 | 1.4.4.19~git38.9951c1101-150300.3.17.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP4 | 389-ds | 0 | 2.0.15~git26.1ea6a6803-150400.3.5.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | 389-ds | 0 | 1.4.2.16~git68.efa843752-150100.7.34.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | 389-ds | 0 | 1.4.2.16~git68.efa843752-150100.7.34.1 |
| SUSE:Linux Enterprise Server 15 SP2-BCL | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Linux Enterprise Server 15-LTSS | 389-ds | 0 | 1.4.0.31~git15.8b9843b0b-150000.4.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | 389-ds | 0 | 1.4.0.31~git15.8b9843b0b-150000.4.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | 389-ds | 0 | 1.4.2.16~git68.efa843752-150100.7.34.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Manager Proxy 4.1 | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Manager Retail Branch Server 4.1 | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| SUSE:Manager Server 4.1 | 389-ds | 0 | 1.4.3.30~git2.ca761af4b-150200.3.29.1 |
| Ubuntu:20.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:22.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:24.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:24.10 | 389-ds-base | 0 | No fix |
| Ubuntu:25.04 | 389-ds-base | 0 | No fix |
| Ubuntu:25.10 | 389-ds-base | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | 389-ds-base | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | 389-ds-base | 0 | No fix |
| openSUSE:Leap 15.3 | 389-ds | 0 | 1.4.4.19~git38.9951c1101-150300.3.17.1 |
| openSUSE:Leap 15.4 | 389-ds | 0 | 2.0.15~git26.1ea6a6803-150400.3.5.1 |
Related vulnerabilities
- CVE-2024-5953 A denial of service vulnerability was found in the 389-ds-base LDAP server. Also affects 389-ds-base
- CVE-2024-3657 A flaw was found in 389-ds-base. Also affects 389-ds-base
- CVE-2024-2199 A denial of service vulnerability was found in 389-ds-base ldap server. Also affects 389-ds-base
- CVE-2024-1062 A heap overflow flaw was found in 389-ds-base. Also affects 389-ds-base
- CVE-2022-0996 A vulnerability was found in the 389 Directory Server that allows expired passwords to… Also affects 389-ds-base
- CVE-2024-8445 The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. Also affects 389-ds-base
- CVE-2024-6237 A flaw was found in the 389 Directory Server. Also affects 389-ds-base
- CVE-2023-1055 A flaw was found in RHDS 11 and RHDS 12. Also affects 389-ds-base