Log in Start free

Vulnerability · Published Jul 28, 2021 · Assigned by mitre

CVE-2021-37600

Medium 5.5

In plain English

A medium-severity security flaw in the util-linux package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.7%top 48.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20util-linux2.37.2-r0ALPINE-CVE-2021-37600
Alpine:v3.21util-linux2.37.2-r0ALPINE-CVE-2021-37600
Alpine:v3.22util-linux2.37.2-r0ALPINE-CVE-2021-37600
Alpine:v3.23util-linux2.37.2-r0ALPINE-CVE-2021-37600
Alpine:v3.24util-linux2.37.2-r0ALPINE-CVE-2021-37600
Debian:12util-linux2.36.1-8DEBIAN-CVE-2021-37600
Debian:13util-linux2.36.1-8DEBIAN-CVE-2021-37600
Debian:14util-linux2.36.1-8DEBIAN-CVE-2021-37600
Ubuntu:22.04:LTSutil-linux2.37.2-4ubuntu2UBUNTU-CVE-2021-37600

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References