PT-2021-3506 · Red Hat+6 · Red Hat+6

Msiddiqu · Published 2021-05-24 · Updated 2024-04-10 · CVE-2021-35937

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux (affected versions not specified)

Description The issue is caused by a race condition in the RPM package manager of Red Hat Enterprise Linux operating systems. Exploitation of this issue may allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

ALSA-2024:0463

ALSA-2024:0647

ALT-PU-2021-2518

ALT-PU-2021-2600

AZL-10766

BDU:2021-03555

CESA-2024_0647

CVE-2021-35937

OESA-2022-1897

RHSA-2024:0424

RHSA-2024:0435

RHSA-2024:0453

RHSA-2024:0463

RHSA-2024:0582

RHSA-2024:0647

RHSA-2024_0463

RHSA-2024_0647

RLSA-2024:0647

Affected Products

Alt Linux

Almalinux

Centos

Debian

Red Hat

Red Os

Rocky Linux

References · 42

• 🔥 https://usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdf · Exploit
• https://errata.rockylinux.org/RLSA-2024:0647 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-35937 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-35937 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-0463.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35937 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-0647.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35939 · Security Note
• https://security.gentoo.org/glsa/202210-22 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:0647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35938 · Security Note
• https://ubuntu.com/security/CVE-2021-35937 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:0647 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-0647.html · Vendor Advisory