PT-2022-10651

CVE-2021-37404

Published

2022-06-13

Updated

2023-06-27

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.10.2 Apache Hadoop versions prior to 3.2.3 Apache Hadoop versions prior to 3.3.2

Description There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. This issue occurs when a file path provided by a user is opened without validation, which may result in a denial of service or arbitrary code execution.

Recommendations For versions prior to 2.10.2, upgrade to Apache Hadoop 2.10.2 or higher. For versions prior to 3.2.3, upgrade to Apache Hadoop 3.2.3 or higher. For versions prior to 3.3.2, upgrade to Apache Hadoop 3.3.2 or higher.

Exploitability

Fix

Impacts

Researchers

Igor Chervatyuk

Vendors

Affected products

Weakness enumeration

CWE-131: Incorrect Calculation of Buffer Size

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

CWE-787: Out-of-bounds Write

Related identifiers