CVE-2021-3567: 
NixOS vulnerability analysis and mitigation

A flaw was discovered in Caribou (CVE-2021-3567) that emerged as a regression of the CVE-2020-25712 fix. The vulnerability affects Caribou versions up to (excluding) 0.4.21 and was disclosed on March 25, 2022. This security issue impacts screen-locking applications that use Caribou as an input mechanism (NVD, Debian Tracker).

The vulnerability is characterized by an Out-of-bounds Write (CWE-787) and Improper Input Validation (CWE-20). The CVSS v3.1 base score is 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible vulnerability with low attack complexity and no requirements for privileges or user interaction (NVD).

The primary impact of this vulnerability is on system availability. When exploited, the vulnerability can cause the Caribou onscreen keyboard to crash, potentially leading to a bypass of screen-locking applications that utilize Caribou as their input mechanism (Red Hat Bugzilla).

The vulnerability has been fixed in Caribou version 0.4.21. The fix was implemented through a merge request and committed to the GNOME GitLab repository. For affected systems, updating to version 0.4.21 or later is recommended (Red Hat Bugzilla).