CVE-2021-21404High· 7.5▾ TwilightCrash due to malformed relay protocol message
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.0%
syncthing can be caused to crash and exit if sent a malformed relay
protocol message message with a negative length field.
The relay server strelaysrv can be caused to crash and exit if sent
a malformed relay protocol message with a negative length field.
At no point is sensitive data exposed or liable to be altered due to this issue. Sensitive data is never exposed to relay operators. Syncthing itself would need to be lured to connect to a malicious relay server in order to exploit the issue.
Fixed in version 1.15.0.
No known workaround for strelaysrv.
syncthing can be configured to not use relays, or to only use specific,
trusted relays. If Syncthing is used in a closed environment or with
relaying disabled, i.e., it does not communicate with unknown relays,
Syncthing is not vulnerable.
If you have any questions or comments about this advisory, please discuss it on the forum.
Thanks to Wojciech Paciorek for discovering and reporting this issue.
github.com/syncthing/syncthing < 1.15.0Upgrade to a patched release:
github.com/syncthing/syncthing 1.15.0