Vulnerability · Published Aug 25, 2022 · Assigned by redhat
CVE-2021-35937
Medium 6.4
In plain English
A medium-severity security flaw in RPM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.4Medium
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python3-rpm | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | python3-rpm | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-apidocs | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-apidocs | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-build | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-build | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-build-libs | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-build-libs | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-cron | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-cron | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-devel | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-devel | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-libs | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-libs | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:9 | rpm-plugin-audit | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-plugin-fapolicyd | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-plugin-fapolicyd | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-plugin-ima | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-plugin-ima | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-plugin-prioreset | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:8 | rpm-plugin-selinux | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-plugin-selinux | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-plugin-syslog | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-plugin-syslog | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-plugin-systemd-inhibit | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-plugin-systemd-inhibit | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:8 | rpm-sign | 4.14.3-28.el8_9 | ALSA-2024:0647 |
| AlmaLinux:9 | rpm-sign | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux:9 | rpm-sign-libs | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| Alpine:v3.20 | rpm | 4.18.0-r0 | ALPINE-CVE-2021-35937 |
| Alpine:v3.21 | rpm | 4.18.0-r0 | ALPINE-CVE-2021-35937 |
| Alpine:v3.22 | rpm | 4.18.0-r0 | ALPINE-CVE-2021-35937 |
| Alpine:v3.23 | rpm | 4.18.0-r0 | ALPINE-CVE-2021-35937 |
| Alpine:v3.24 | rpm | 4.18.0-r0 | ALPINE-CVE-2021-35937 |
| Debian:12 | rpm | 4.18.0+dfsg-1 | DEBIAN-CVE-2021-35937 |
| Debian:13 | rpm | 4.18.0+dfsg-1 | DEBIAN-CVE-2021-35937 |
| Debian:14 | rpm | 4.18.0+dfsg-1 | DEBIAN-CVE-2021-35937 |
| Rocky Linux:8 | rpm | 0:4.14.3-28.el8_9 | RLSA-2024:0647 |
| Ubuntu:22.04:LTS | rpm | no fix listed | UBUNTU-CVE-2021-35937 |
Affected products (as reported)
Weakness: CWE-59