CVE-2021-29482: 
NixOS vulnerability analysis and mitigation

The vulnerability CVE-2021-29482 affects the xz compression and decompression library written in Go. The issue was discovered in the readUvarint function used to read the xz container format, which could enter an infinite loop when provided with malicious input. The vulnerability was fixed in release v0.5.8 (GitHub Advisory).

The vulnerability stems from the readUvarint function lacking proper bounds checking, which could result in an infinite loop when processing malicious input. The issue is similar to CVE-2020-16845 found in the Go Standard Library. The fix implemented in version 0.5.8 adds a check for the number of bytes read and reports an overflow after more than 10 bytes are read, which is the ceiling of 64/7 (GitHub Commit). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability can lead to a denial of service condition when processing maliciously crafted input. The impact is primarily on the availability of systems using the affected versions of the xz library, as it could cause the application to enter an infinite loop (GitHub Advisory).

The vulnerability can be triggered by providing malicious input to the readUvarint function. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) (NVD).

The primary mitigation is to upgrade to version 0.5.8 or later of the xz library. For users unable to upgrade immediately, a recommended workaround is to limit the size of the compressed file input to a reasonable size for their use case (GitHub Advisory).