Sign-up

ID

VAR-202103-1061


CVE

CVE-2021-27646


TITLE

Synology DiskStation Manager  Vulnerabilities in the use of freed memory

Trust: 0.8

sources: JVNDB: JVNDB-2021-004442

DESCRIPTION

Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. Synology DiskStation Manager (DSM) Is vulnerable to the use of freed memory.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Authentication is not required to exploit this vulnerability.The specific flaw exists within the iscsi_snapshot_comm_core service. The issue results from the lack of proper locking when performing operations on an object, which can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the current process. Synology DiskStation Manager (DSM) is an operating system for network storage servers (NAS) developed by Synology, Taiwan. The operating system can manage data, documents, photos, music and other information

Trust: 2.43

sources: NVD: CVE-2021-27646 // JVNDB: JVNDB-2021-004442 // ZDI: ZDI-21-340 // VULHUB: VHN-386939 // VULMON: CVE-2021-27646

AFFECTED PRODUCTS

vendor:synologymodel:diskstation managerscope:ltversion:6.2.3-25426-3

Trust: 1.0

vendor:synologymodel:diskstation managerscope:eqversion: -

Trust: 0.8

vendor:synologymodel:diskstation managerscope:eqversion:6.2.3-25426-3

Trust: 0.8

vendor:synologymodel:diskstation managerscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-340 // JVNDB: JVNDB-2021-004442 // NVD: CVE-2021-27646

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-27646
value: CRITICAL

Trust: 1.0

security@synology.com: CVE-2021-27646
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-27646
value: CRITICAL

Trust: 0.8

ZDI: CVE-2021-27646
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202103-902
value: CRITICAL

Trust: 0.6

VULHUB: VHN-386939
value: HIGH

Trust: 0.1

VULMON: CVE-2021-27646
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-27646
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-386939
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-27646
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

OTHER: JVNDB-2021-004442
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2021-27646
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-340 // VULHUB: VHN-386939 // VULMON: CVE-2021-27646 // JVNDB: JVNDB-2021-004442 // CNNVD: CNNVD-202103-902 // NVD: CVE-2021-27646 // NVD: CVE-2021-27646

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:Use of freed memory (CWE-416) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-386939 // JVNDB: JVNDB-2021-004442 // NVD: CVE-2021-27646

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202103-902

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202103-902

PATCH

title:Synology-SA-20url:https://www.synology.com/ja-jp/security/advisory/Synology_SA_20_26

Trust: 0.8

title:Synology has issued an update to correct this vulnerability.url:https://www.synology.com/zh-hk/security/advisory/Synology_SA_20_26

Trust: 0.7

title:Synology DiskStation Manager Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=144322

Trust: 0.6

sources: ZDI: ZDI-21-340 // JVNDB: JVNDB-2021-004442 // CNNVD: CNNVD-202103-902

EXTERNAL IDS

db:NVDid:CVE-2021-27646

Trust: 3.3

db:ZDIid:ZDI-21-340

Trust: 2.5

db:ZDIid:ZDI-21-339

Trust: 1.8

db:JVNDBid:JVNDB-2021-004442

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-13476

Trust: 0.7

db:CNNVDid:CNNVD-202103-902

Trust: 0.7

db:VULHUBid:VHN-386939

Trust: 0.1

db:VULMONid:CVE-2021-27646

Trust: 0.1

sources: ZDI: ZDI-21-340 // VULHUB: VHN-386939 // VULMON: CVE-2021-27646 // JVNDB: JVNDB-2021-004442 // CNNVD: CNNVD-202103-902 // NVD: CVE-2021-27646

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-21-339/

Trust: 1.9

url:https://www.synology.com/security/advisory/synology_sa_20_26

Trust: 1.8

url:https://www.zerodayinitiative.com/advisories/zdi-21-340/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-27646

Trust: 1.4

url:https://www.synology.com/zh-hk/security/advisory/synology_sa_20_26

Trust: 0.7

url:https://cwe.mitre.org/data/definitions/416.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-21-340 // VULHUB: VHN-386939 // VULMON: CVE-2021-27646 // JVNDB: JVNDB-2021-004442 // CNNVD: CNNVD-202103-902 // NVD: CVE-2021-27646

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-21-340

SOURCES

db:ZDIid:ZDI-21-340
db:VULHUBid:VHN-386939
db:VULMONid:CVE-2021-27646
db:JVNDBid:JVNDB-2021-004442
db:CNNVDid:CNNVD-202103-902
db:NVDid:CVE-2021-27646

LAST UPDATE DATE

2024-11-23T21:34:50.483000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-340date:2021-05-24T00:00:00
db:VULHUBid:VHN-386939date:2021-03-26T00:00:00
db:VULMONid:CVE-2021-27646date:2021-03-26T00:00:00
db:JVNDBid:JVNDB-2021-004442date:2021-11-22T08:22:00
db:CNNVDid:CNNVD-202103-902date:2021-03-23T00:00:00
db:NVDid:CVE-2021-27646date:2024-11-21T05:58:22.263

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-340date:2021-03-22T00:00:00
db:VULHUBid:VHN-386939date:2021-03-12T00:00:00
db:VULMONid:CVE-2021-27646date:2021-03-12T00:00:00
db:JVNDBid:JVNDB-2021-004442date:2021-11-22T00:00:00
db:CNNVDid:CNNVD-202103-902date:2021-03-12T00:00:00
db:NVDid:CVE-2021-27646date:2021-03-12T07:15:13.717