Quick answers
- Is CVE-2021-32297 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-32297 being exploited in the wild.
- How severe is CVE-2021-32297?
- Low severity, with a CVSS score of 3.1, published 20 September 2021.
- Which products and versions are affected?
- lief (PyPI) ECOSYSTEM:introduced=0,fixed=0.11.0, ECOSYSTEM:introduced=0,fixed=0.11.5.
- Is there a fix for CVE-2021-32297?
- Yes. lief (PyPI): upgrade to 0.11.0, 0.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-32297 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-32297?
- Check whether you run lief (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- lief (PyPI): upgrade to 0.11.0, 0.11.5 or later
pip install "lief>=0.11.5"
Technical details
A heap-buffer-overflow exists in LIEF's PE binary parser, specifically in the pe_reader.c component during section initialization. The vulnerability is triggered when processing a specially crafted PE file, causing a one-byte out-of-bounds read/write that can be leveraged for code execution. The attack vector requires user interaction (opening a malicious PE file), but no authentication is needed. The vulnerability affects all versions prior to 0.11.0, with the fix committed to the LIEF repository. The root cause is improper bounds checking when initializing PE sections in the C API wrapper.
Affected products
- LIEF Project LIEF prior to 0.11.0
Identifiers
- CVE-2021-32297
- GHSA-22x7-vwh9-5w4g
- PYSEC-2021-324
Timeline
- 2021-09-20: disclosed
- 0.11.0: patched