Log in Start free

Vulnerability · Published Jul 22, 2021 · Assigned by mitre

CVE-2021-35942

Critical 9.1

In plain English

A critical-severity security flaw in the compat-libpthread-nonshared package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.8%top 13.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8compat-libpthread-nonshared2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-benchtests2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-nss-devel2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-static2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-utils2.28-164.el8ALSA-2021:4358
AlmaLinux:8nss_hesiod2.28-164.el8ALSA-2021:4358
Debian:12glibc2.31-13DEBIAN-CVE-2021-35942
Debian:13glibc2.31-13DEBIAN-CVE-2021-35942
Debian:14glibc2.31-13DEBIAN-CVE-2021-35942
Rocky Linux:8glibc0:2.28-164.el8RLSA-2021:4358

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-704 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References