PT-2021-3512 · Gnu+10 · Glibc+10
Philippe Antoine
·
Published
2020-12-17
·
Updated
2024-06-15
·
CVE-2021-35942
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
glibc versions prior to 2.33
Description
The issue is related to the wordexp function in the GNU C Library, which may crash or read arbitrary memory when called with an untrusted, crafted pattern. This could result in a denial of service or disclosure of information due to the incorrect use of atoi instead of strtoul for calculations. The vulnerability is also described as being caused by an integer overflow, potentially allowing an attacker to read arbitrary files.
Recommendations
For glibc versions prior to 2.33, update to version 2.33 or later to resolve the issue. As a temporary workaround, consider restricting the use of the wordexp function with untrusted input until a patch is available.
Fix
DoS
Incorrect Type Conversion or Cast
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Glibc