basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory…
Priority LOW 36CWE-770Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08792 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* | before 246.15; 247 to before 247.8; 248 to before 248.5; 249 to before 249.1 | Vulnerable | systemd |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* Versions before 246.15; 247 to before 247.8; 248 to before 248.5; 249 to before 249.1 Vulnerable ·systemd
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 4 advisories
- RHSA-2021:2736 Released 2021-07-22 · Red Hat rating ImportantRed Hat Virtualization Host security and bug fix update [ovirt-4.4.7]
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.7-20210715.1.el8_4, redhat-virtualization-host-image-update-4.4.7-20210715.1.el8_4
- RHSA-2021:2717 Released 2021-07-21 · Red Hat rating Importantsystemd security update
- Red Hat Enterprise Linux BaseOS (v. 8) systemd-239-45.el8_4.2, systemd-container-239-45.el8_4.2, systemd-devel-239-45.el8_4.2 +5
- RHSA-2021:2721 Released 2021-07-20 · Red Hat rating Importantsystemd security update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.2) systemd-239-31.el8_2.4, systemd-container-239-31.el8_2.4, systemd-devel-239-31.el8_2.4 +5
Show 1 more Red Hat advisories
- RHSA-2021:2724 Released 2021-07-20 · Red Hat rating Importantsystemd security update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.1) systemd-239-18.el8_1.8, systemd-container-239-18.el8_1.8, systemd-devel-239-18.el8_1.8 +5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:2717 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.1) | Fixed | RHSA-2021:2724 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.2) | Fixed | RHSA-2021:2721 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2021:2736 |
Not affected: 4 products
- RHEL 8-based RHEV-H for RHEV 4 (build requirements)
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat Virtualization 4 Hypervisor for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33910
- 2026-10-03 Alias added: GHSA-5337-wcgc-wcvp
References
Exploit 2
Patch 9
- https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
- https://github.com/systemd/systemd/commit/b34a4f0e6729de292cb3b0c03c1d48f246ad896b
- https://github.com/systemd/systemd-stable/commit/cfd14c65374027b34dbbc4f0551456c5dc2d1f61
- https://github.com/systemd/systemd-stable/commit/b00674347337b7531c92fdb65590ab253bb57538
- https://github.com/systemd/systemd-stable/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b
- https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce
- [oss-security] 20210804 Re: Pop!_OS Membership to linux-distros list
- [oss-security] 20210817 Re: Pop!_OS Membership to linux-distros list
- [oss-security] 20210907 Re: Pop!_OS Membership to linux-distros list
Advisory 5
Sources
- CVE-2021-33910 · CVE Program
- CVE-2021-33910 · NVD
- FIRST EPSS
- GHSA-5337-wcgc-wcvp · GitHub Advisory Database · CC BY 4.0
- CVE-2021-33910 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences