Vulnerability · Published Mar 26, 2021 · Assigned by redhat

CVE-2021-20197

Medium 6.3

In plain English

A medium-severity security flaw in binutils. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	binutils-devel	2.30-108.el8	ALSA-2021:4364
Debian:12	binutils	2.37-3	DEBIAN-CVE-2021-20197
Debian:13	binutils	2.37-3	DEBIAN-CVE-2021-20197
Debian:14	binutils	2.37-3	DEBIAN-CVE-2021-20197
Rocky Linux:8	binutils	0:2.30-108.el8	RLSA-2021:4364

Affected products (as reported)

Vendor	Product	Versions
n/a	binutils	binutils 2.35

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://bugzilla.redhat.com/show_bug.cgi?id=1913743 x_refsource_MISC
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210528-0009/ x_refsource_CONFIRM
GLSA-202208-30 vendor-advisory, x_refsource_GENTOO