CVE-2021-28905: 
NixOS vulnerability analysis and mitigation

CVE-2021-28905 affects libyang versions up to and including v1.0.225. The vulnerability was discovered in the lys_node_free() function where it incorrectly assumes that node->module cannot be NULL, but in certain cases, it can be null, which triggers a reachable assertion (NVD, Gentoo Advisory).

The vulnerability is classified as a reachable assertion (CWE-617) issue in the lys_node_free() function. The CVSS v3.1 base score is 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network accessible, requires low attack complexity, and primarily impacts system availability (NVD).

The vulnerability can trigger a reachable assertion when node->module is NULL, which can lead to a Denial of Service condition. This affects the availability of systems using the vulnerable versions of libyang (NVD, Gentoo Advisory).

The vulnerability is exploitable remotely and requires low attack complexity with no privileges or user interaction needed. The issue has been documented in the public issue tracker (GitHub Issue).

Users should upgrade to libyang version greater than 1.0.225. For Gentoo Linux users specifically, the recommendation is to upgrade to version 1.0.236 or later using the command 'emerge --ask --oneshot --verbose ">=net-libs/libyang-1.0.236"' (Gentoo Advisory).