CVE-2021-4156
High · 7.1CVSS
7.1
EPSS
1.8%
Published
Mar 23, 2022
CISA due date
—
Cloudanix analysis
A flaw in a common audio library can make programs crash or leak information when they open certain sound files, so organizations should update the library to keep media-handling tools stable and secure.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- Library
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read in libsndfile FLAC codec that can cause application crash or disclose memory contents usable for further attacks.
Why it matters to the business
Applications processing untrusted FLAC audio files may crash or leak data, disrupting media handling workflows and opening paths for additional compromise in environments still using older libsndfile builds.
How an attack unfolds
An attacker crafts a malicious FLAC file that triggers the out-of-bounds read when decoded by libsndfile and delivers it to a target user or system that automatically or interactively processes the file with a vulnerable application.
How to fix it
Upgrade libsndfile to a version containing the FLAC codec bounds check fix; rebuild and redeploy any dependent applications; replace or isolate any remaining vulnerable instances on Debian or other distributions.
How to confirm the fix worked
Confirm installed libsndfile version is newer than the vulnerable release; run regression tests with known-malformed FLAC samples; monitor application stability under untrusted file ingestion.
Typical attack path
- Identify or create a target application that links against libsndfile and handles FLAC input
- Craft a malformed FLAC file that triggers the out-of-bounds read
- Deliver the file via email, download link, or media import workflow
- Victim opens or the application processes the file
- Application crashes or leaks memory that may aid subsequent exploitation
How to detect it
Review application crash logs and core dumps for libsndfile FLAC decoding paths; correlate user-reported file-open events with sudden process terminations involving audio codecs.
What your security team should do
- Prioritize upgrade of libsndfile in all media-processing pipelines within 30 days
- Disable automatic processing of FLAC files from untrusted sources until patched
- Add file-type sandboxing or content-disarm-and-reconstruction for audio imports
- Scan build pipelines and container images for vulnerable libsndfile versions
The record
An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | libsndfile | 0 | 1.0.28-12.el8 |
| AlmaLinux:8 | libsndfile-devel | 0 | 1.0.28-12.el8 |
| Debian:10 | libsndfile | 0 | 1.0.28-6+deb10u2 |
| Debian:11 | libsndfile | 0 | No fix |
| Debian:12 | libsndfile | 0 | 1.1.0-1 |
| Debian:13 | libsndfile | 0 | 1.1.0-1 |
| Debian:9 | libsndfile | 0 | 1.0.27-3+deb9u3 |
| Red Hat:enterprise_linux:8::appstream | libsndfile | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::appstream | libsndfile-debuginfo | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::appstream | libsndfile-debugsource | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::appstream | libsndfile-devel | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::appstream | libsndfile-utils-debuginfo | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::crb | libsndfile | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::crb | libsndfile-debuginfo | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::crb | libsndfile-debugsource | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::crb | libsndfile-devel | 0 | 0:1.0.28-12.el8 |
| Red Hat:enterprise_linux:8::crb | libsndfile-utils-debuginfo | 0 | 0:1.0.28-12.el8 |
| Rocky Linux:8 | libsndfile | 0 | 0:1.0.28-12.el8 |
| SUSE:Enterprise Storage 6 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Enterprise Storage 7 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:HPE Helion OpenStack 8 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP3 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP3 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | libsndfile | 0 | 1.0.20-2.19.18.1 |
| SUSE:Linux Enterprise Real Time 15 SP2 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | libsndfile | 0 | 1.0.20-2.19.18.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server 12 SP3-BCL | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server 12 SP3-LTSS | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server 12 SP5 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server 15 SP2-BCL | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server 15-LTSS | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:Manager Proxy 4.1 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Manager Retail Branch Server 4.1 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:Manager Server 4.1 | libsndfile | 0 | 1.0.28-5.15.1 |
| SUSE:OpenStack Cloud 8 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:OpenStack Cloud 9 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:OpenStack Cloud Crowbar 8 | libsndfile | 0 | 1.0.25-36.26.1 |
| SUSE:OpenStack Cloud Crowbar 9 | libsndfile | 0 | 1.0.25-36.26.1 |
| Ubuntu:20.04:LTS | libsndfile | 0 | No fix |
| Ubuntu:20.04:LTS | libsndfile | 0 | 1.0.28-7ubuntu0.3 |
| Ubuntu:22.04:LTS | libsndfile | 0 | No fix |
| Ubuntu:22.04:LTS | libsndfile | 0 | 1.0.31-2ubuntu0.2 |
| Ubuntu:Pro:14.04:LTS | libsndfile | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | libsndfile | 0 | 1.0.25-7ubuntu2.2+esm4 |
| Ubuntu:Pro:16.04:LTS | libsndfile | 0 | 1.0.25-10ubuntu0.16.04.3+esm2 |
| Ubuntu:Pro:18.04:LTS | libsndfile | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libsndfile | 0 | 1.0.28-4ubuntu0.18.04.2+esm2 |
| conan | libsndfile | 1.1.10 | No fix |
| openSUSE:Leap 15.3 | libsndfile | 0 | 1.0.28-5.15.1 |
| openSUSE:Leap 15.3 | libsndfile-progs | 0 | 1.0.28-5.15.1 |
| openSUSE:Tumbleweed | libsndfile | 0 | 1.0.31-3.1 |
Related vulnerabilities
- CVE-2024-50612 libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read. Also affects libsndfile
- CVE-2022-33065 Multiple signed integers overflow in function au_read_header in src/au.c and in functions… Also affects libsndfile
- CVE-2017-14245 An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may… Also affects libsndfile
- CVE-2014-9496 The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have… Also affects libsndfile
- CVE-2024-50613 libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in… Also affects libsndfile
- CVE-2017-12562 Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile… Also affects libsndfile
- CVE-2017-7585 In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can… Also affects libsndfile
- CVE-2015-7805 Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have… Also affects libsndfile