GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cpio | May 13, 2022 | Aug 8, 2021 |
| Alpine Linux | — | Upgrade cpio | Aug 22, 2024 | Aug 7, 2021 |
| Amazon Linux Ami 2 | — | Upgrade cpio-debuginfoUpgrade cpio | Mar 7, 2023 | Aug 8, 2021 |
| Amazon_linux_2023 | — | Upgrade cpio-debugsourceUpgrade cpioUpgrade cpio-debuginfo | Feb 17, 2025 | Aug 6, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 7, 2021 |
| Centos_linux | — | Upgrade cpioUpgrade cpio-debuginfoUpgrade cpio-debugsource | May 13, 2022 | Aug 8, 2021 |
| Debian | — | Upgrade cpio | Jun 6, 2023 | Aug 8, 2021 |
| Gentoo Linux | — | Upgrade app-arch/cpio. | Jul 3, 2024 | Aug 8, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cpio | Nov 12, 2021 | Aug 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade cpio | Nov 2, 2021 | Aug 8, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade cpio | Nov 12, 2021 | Aug 8, 2021 |
| Oracle_linux | — | Upgrade cpio | May 18, 2022 | Aug 6, 2021 |
| Redhat_linux | — | Upgrade cpio-debuginfoUpgrade cpio-debugsourceUpgrade cpioNo solution exists | May 13, 2022 | Aug 8, 2021 |
| Rocky_linux | — | Upgrade cpioUpgrade cpio-debuginfoUpgrade cpio-debugsource | Mar 5, 2024 | Aug 8, 2021 |
| Suse | — | Upgrade cpio-mtUpgrade cpioUpgrade cpio-lang | Aug 13, 2021 | Aug 8, 2021 |
| Ubuntu | — | Upgrade cpio (Ubuntu Pro)Upgrade cpio | Sep 9, 2021 | Aug 8, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 7, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub