CVE - CVE-2021-3999

CVE-ID
CVE-2021-3999	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:[debian-lts-announce] 20221017 [SECURITY] [DLA 3152-1] glibc security update URL:https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html MISC:https://access.redhat.com/security/cve/CVE-2021-3999 URL:https://access.redhat.com/security/cve/CVE-2021-3999 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=2024637 URL:https://bugzilla.redhat.com/show_bug.cgi?id=2024637 MISC:https://security-tracker.debian.org/tracker/CVE-2021-3999 URL:https://security-tracker.debian.org/tracker/CVE-2021-3999 MISC:https://security.netapp.com/advisory/ntap-20221104-0001/ URL:https://security.netapp.com/advisory/ntap-20221104-0001/ MISC:https://sourceware.org/bugzilla/show_bug.cgi?id=28769 URL:https://sourceware.org/bugzilla/show_bug.cgi?id=28769 MISC:https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e URL:https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e MISC:https://www.openwall.com/lists/oss-security/2022/01/24/4 URL:https://www.openwall.com/lists/oss-security/2022/01/24/4
Assigning CNA
Red Hat, Inc.
Date Record Created
20211122	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20211122)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)