Vulnerability Description
sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Squirrel-Lang | Squirrel | <= 2.2.5 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- http://www.squirrel-lang.org/#downloadThird Party Advisory
- https://blog.sonarsource.com/squirrel-vm-sandbox-escape/ExploitThird Party Advisory
- https://github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4ddPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- http://www.squirrel-lang.org/#downloadThird Party Advisory
- https://blog.sonarsource.com/squirrel-vm-sandbox-escape/ExploitThird Party Advisory
- https://github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4ddPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2021-41556?
CVE-2021-41556 is a vulnerability with a CVSS score of 10.0 (CRITICAL). sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel s...
How severe is CVE-2021-41556?
CVE-2021-41556 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-41556?
Check the references section above for vendor advisories and patch information. Affected products include: Squirrel-Lang Squirrel, Fedoraproject Fedora.