CVE-2021-46019: 
NixOS vulnerability analysis and mitigation

CVE-2021-46019 is a vulnerability discovered in GNU Recutils v1.8.90, specifically affecting the rec_db_destroy() function in rec-db.c. The vulnerability was disclosed on January 14, 2022, and involves an untrusted pointer dereference that can lead to a segmentation fault or application crash (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.5 (Medium). The issue occurs in the rec_db_destroy() function at rec-db.c where an untrusted pointer dereference can trigger a segmentation fault. The vulnerability requires local access and user interaction to be exploited (NVD, Ubuntu).

When exploited, this vulnerability can cause a denial of service through application crash via segmentation fault. The impact is primarily limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability has been fixed in subsequent releases of GNU Recutils. Various Linux distributions have released patches, including Ubuntu which has provided fixes through Ubuntu Pro for versions 22.04 LTS, 20.04 LTS, 18.04 ESM, and 16.04 ESM. Fedora has also released fixes for versions 35 and 36 (Ubuntu, Fedora Update).