CVE-2021-21417: 
NixOS vulnerability analysis and mitigation

FluidSynth, a software synthesizer based on the SoundFont 2 specifications, was found to contain a use-after-free vulnerability (CVE-2021-21417) that could be triggered when loading an invalid SoundFont file. The vulnerability was discovered in versions 2.1.7 and earlier, with a fix released in version 2.1.8 (GitHub Advisory).

The vulnerability stems from improper handling of invalid generators in the zone list. When processing a malformed SoundFont file that doesn't contain a Gen_SampleId, the code incorrectly removes elements from the zone list, leading to a use-after-free condition. The issue occurs because fluid_list_remove() was not receiving the correct pointer to the beginning of the list, causing elements to remain in the list after they should have been removed (GitHub Issue, GitHub PR).

The vulnerability could potentially lead to arbitrary code execution or denial of service (DoS) when processing specially crafted SoundFont files (Debian Advisory).

The vulnerability can be triggered by loading a malformed SoundFont file into an application using the FluidSynth library. Programs like VLC that use this library were affected by this vulnerability (GitHub Issue).

Users are advised to upgrade to FluidSynth version 2.1.8 or later, which contains the fix for this vulnerability. No workarounds are available for this issue (GitHub Advisory).