CVE-2021-44568: 
NixOS vulnerability analysis and mitigation

Two heap-overflow vulnerabilities were discovered in openSUSE/libsolv through December 13, 2020. The vulnerabilities exist in the decisionmap variable via the resolve_dependencies function at src/solver.c (lines 1940 & 1995). These vulnerabilities were assigned CVE-2021-44568 (NVD).

The vulnerability involves two distinct heap-overflow issues in the resolve_dependencies function. The first occurs at line 1940 when accessing decisionmap[-r->p], and the second at line 1995 when accessing decisionmap[p]. Both vulnerabilities arise when the index values exceed the size of the decisionmap array, leading to buffer overflow conditions. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) and a CVSS v2.0 Base Score of 4.3 (Medium) (NVD).

The exploitation of these vulnerabilities could result in a remote Denial of Service (DoS) attack. When triggered, the heap-buffer-overflow conditions can cause the application to crash or become unresponsive (GitHub Issue).

The vulnerability was addressed in libsolv version 0.7.17. Users are advised to upgrade to this version or later to mitigate the risk (Debian Tracker).