Log in Start free

Vulnerability · Published Feb 24, 2021 · Assigned by mitre

CVE-2021-27645

Low 2.5

In plain English

A low-severity double free in the compat-libpthread-nonshared package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.4%top 67.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8compat-libpthread-nonshared2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-benchtests2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-nss-devel2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-static2.28-164.el8ALSA-2021:4358
AlmaLinux:8glibc-utils2.28-164.el8ALSA-2021:4358
AlmaLinux:8nss_hesiod2.28-164.el8ALSA-2021:4358
Debian:12glibc2.31-10DEBIAN-CVE-2021-27645
Debian:13glibc2.31-10DEBIAN-CVE-2021-27645
Debian:14glibc2.31-10DEBIAN-CVE-2021-27645
Rocky Linux:8glibc0:2.28-164.el8RLSA-2021:4358

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References