CVE-2021-33477: 
NixOS vulnerability analysis and mitigation

CVE-2021-33477 affects multiple terminal emulators including rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7. The vulnerability was discovered in May 2021 and involves improper handling of certain escape sequences (ESC G Q), which could allow potentially remote code execution (CVE Details, Debian LTS).

The vulnerability stems from the improper handling of ANSI escape sequence ESC G Q (\eGQ, \033GQ, \x1bGQ) which queries the availability of graphics. The terminal responds to this query with a newline-terminated message, which can be exploited when combined with other escape sequences. Specifically, when using bash as the shell, the VT52 mode escape sequence can be used to trigger tab completion and execute files from subdirectories in the current directory (OSS Security).

The vulnerability allows attackers to potentially execute arbitrary code with the privileges of the terminal process. This can be triggered when a user runs programs that handle untrusted data within the affected terminal emulators. The impact is particularly severe when processing output from untrusted sources such as log files or remote content (Gentoo Security, OSS Security).

The vulnerability is exploitable when a user processes untrusted content in the affected terminal emulators. Proof-of-concept exploits have been demonstrated through various attack vectors, including SCP file transfers and processing of specially crafted files. The exploitation requires the target to use bash as their shell and one of the affected terminal emulators (OSS Security).

Various distributions have released patches to address this vulnerability. For rxvt-unicode, version 9.26 includes fixes for this issue. Gentoo users should upgrade to version >= 9.22-r9, while Debian users should upgrade to version 9.22-1+deb9u1. For systems where patches are not available, users are advised to avoid using the affected terminal emulators when processing untrusted content (Fedora Update, Gentoo Security).