A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-3152-1 | glibc security update |
EUVD |
EUVD-2021-27189 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system. |
Ubuntu USN |
USN-5310-1 | GNU C Library vulnerabilities |
Ubuntu USN |
USN-5310-2 | GNU C Library vulnerabilities |
Ubuntu USN |
USN-6762-1 | GNU C Library vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-03T17:16:03.318Z
Reserved: 2021-11-22T00:00:00
Link: CVE-2021-3999
No data.
Status : Modified
Published: 2022-08-24T16:15:09.077
Modified: 2024-11-21T06:23:20.937
Link: CVE-2021-3999
OpenCVE Enrichment
No data.
Debian DLA
EUVD
Ubuntu USN