by Kastro
Paper/Archive/CVE-2021-3177

CVE-2021-3177

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain P…

EPSS 24%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.8.978 × 2019.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refbugs.python.org/issue42938refgithub.com/python/cpython/pull/24239refpython-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.htmladvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXCadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNAadvisorysecurity.gentoo.org/glsa/202101-18advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOOadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4Aadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUOadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWKadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSDadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKUadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7Oadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5Eadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62reflists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Eadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGAreflists.debian.org/debian-lts-announce/2021/04/msg00005.htmlreforacle.com//security-alerts/cpujul2021.htmlrefnews.ycombinator.com/item?id=26185005refsecurity.netapp.com/advisory/ntap-20210226-0003reforacle.com/security-alerts/cpuoct2021.htmlreforacle.com/security-alerts/cpujan2022.htmlreflists.debian.org/debian-lts-announce/2022/02/msg00013.htmlreforacle.com/security-alerts/cpujul2022.htmlreflists.debian.org/debian-lts-announce/2023/05/msg00024.htmlrefcert-portal.siemens.com/productcert/html/ssa-398330.html