CVE-2021-40391
Published: 19 November 2021
Summary
CVE-2021-40391 is a critical-severity Detection of Error Condition Without Action (CWE-390) vulnerability in Gerbv Project Gerbv. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 34.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-27568
Vulnerability details
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide…
more
a malicious file to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires explicit action (alert plus additional responses) on audit logging failures rather than detecting the error condition without acting.
Procedures require detection of error/incident conditions followed by defined response actions.
IR testing verifies that detected error conditions trigger appropriate response actions rather than being ignored.
Provides assistance for handling incidents, ensuring detected error conditions lead to appropriate user actions rather than inaction.
Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state.
Mandates defined procedures that ensure exceptional conditions are handled in a controlled, secure manner instead of being ignored or mishandled.
The control mandates response actions to address results from monitoring and assessments, preventing detection of error conditions without subsequent corrective action.
Supplies a concrete handling action (safe mode) for exceptional conditions, mitigating risks from improper or absent handling that could allow continued attacks.