CVE-2021-3999

Updated: 2026-02-27 00:50:27.873961

Description:

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x 0.0
CVSS Version 3.x HIGH 7.8

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

AlmaLinux 9.2 ESU glibc 2.34 7.8 HIGH Already Fixed 2024-05-15 10:24:50
CentOS 6 ELS glibc 2.12 7.8 HIGH Released CLSA-2022:1648138117 2022-05-05 12:05:00
CentOS 7 ELS glibc 2.17 7.8 HIGH Already Fixed 2024-07-08 11:35:51
CentOS 8.4 ELS glibc 2.28 7.8 HIGH Released CLSA-2022:1648147764 2022-03-24 18:56:18
CentOS 8.5 ELS glibc 2.28 7.8 HIGH Released CLSA-2022:1648149189 2022-03-24 18:56:21
CloudLinux 6 ELS glibc 2.12 7.8 HIGH Released CLSA-2022:1648142149 2022-04-07 13:04:02
Oracle Linux 6 ELS glibc 2.12 7.8 HIGH Released CLSA-2022:1648138064 2022-03-24 18:56:18
Ubuntu 16.04 ELS glibc 2.23-0 7.8 HIGH Released CLSA-2022:1648149396 2022-03-24 18:56:18
Ubuntu 18.04 ELS glibc 2.27-3 7.8 HIGH Already Fixed 2023-06-02 09:09:55