Description
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Debian / debian_linux10.0 – 10.0
- Debian / debian_linux11.0 – 11.0
- gnu / glibc2.31
- NetApp / e-series_performance_analyzer
- NetApp / h300s_firmware
- NetApp / h410c_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h700s_firmware
- NetApp / nfs_plug-in
- NetApp / ONTAP Select Deploy administration utility
References
- MAILING_LISThttps://www.openwall.com/lists/oss-security/2022/01/24/4
- MISChttps://sourceware.org/bugzilla/show_bug.cgi?id=28769
- MISChttps://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2024637
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2021-3999
- VENDOR_ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-3999
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- MISChttps://security.netapp.com/advisory/ntap-20221104-0001/
Updated 16m ago · 8 sources