PT-2022-2035 · Glibc+4 · Glibc+4

Siddhesh Poyarekar · Published 2022-02-01 · Updated 2024-06-15 · CVE-2021-3998

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions glibc (affected versions not specified)

Description A flaw was found in the realpath() function of glibc, which can mistakenly return an unexpected value. This issue is related to memory release errors and can potentially lead to information leakage and disclosure of sensitive data. Exploitation of this flaw may allow a remote attacker to access confidential information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unchecked Return Value

Out of bounds Read

Memory Leak

Weakness Enumeration

CWE-252

CWE-125

CWE-401

Related Identifiers

ALT-PU-2022-1201

ALT-PU-2022-1215

AZL-10675

BDU:2022-01634

CVE-2021-3998

OPENSUSE-SU-2024:11850-1

USN-5310-1

Affected Products

Alt Linux

Linuxmint

Red Os

Ubuntu

Glibc

References · 40

• https://nvd.nist.gov/vuln/detail/CVE-2021-3998 · Security Note
• https://ubuntu.com/security/CVE-2016-10228 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01634 · Security Note
• https://ubuntu.com/security/CVE-2020-6096 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35942 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3326 · Vendor Advisory
• https://openwall.com/lists/oss-security/2022/01/24/4 · Patch
• https://sourceware.org/bugzilla/show_bug.cgi?id=28770 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29562 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10675 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3998 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2024633 · Patch
• https://ubuntu.com/security/CVE-2019-25013 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5310-1 · Vendor Advisory