Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2021-36089
CVE-2021-36089:
Homebrew vulnerability analysis and mitigation
Overview
Grok versions 7.6.6 through 9.2.0 contain a heap-based buffer overflow vulnerability in the grk::FileFormatDecompress::apply_palette_clr function (called from grk::FileFormatDecompress::applyColour). The vulnerability was discovered and disclosed in April 2021 (OSS-Fuzz).
Technical details
The vulnerability is classified as a heap-based buffer overflow WRITE vulnerability of 16 bytes occurring in the grk::FileFormatDecompress::apply_palette_clr function, which is called from grk::FileFormatDecompress::applyColour. The issue was identified through the OSS-Fuzz project and has been assigned a HIGH severity rating (OSS-Fuzz-Vulns).
Impact
A successful exploitation of this heap buffer overflow vulnerability could potentially lead to arbitrary code execution or system crashes, as heap buffer overflows typically allow attackers to corrupt memory and potentially execute malicious code (OSS-Fuzz-Vulns).
Exploitability
The vulnerability affects multiple versions of Grok, from version 7.6.6 through version 9.2.0, including various debian and intermediate releases. The issue was introduced in commit 7e45c17f3700085a60db0467954230e9f6dd4b2d (OSS-Fuzz-Vulns).
Mitigation and workarounds
Users should upgrade to a version newer than 9.2.0 to mitigate this vulnerability. The issue has been addressed in subsequent releases of Grok (Grok-Releases).
Additional resources
Source: This report was generated using AI
Related Homebrew vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management