CVE-2021-46974

The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46974.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "4.14.113"
            },
            {
                "fixed": "4.14.233"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "4.19.19"
            },
            {
                "fixed": "4.19.190"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.0"
            },
            {
                "fixed": "5.4.117"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.5"
            },
            {
                "fixed": "5.10.35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.11"
            },
            {
                "fixed": "5.11.19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.12"
            },
            {
                "fixed": "5.12.2"
            }
        ]
    }
]