Description
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a glibc
Fixed in glibc v2.31 and above.affected
References
- https://www.openwall.com/lists/oss-security/2022/01/24/4 ↗
- https://sourceware.org/bugzilla/show_bug.cgi?id=28769 ↗
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2024637 ↗
- https://access.redhat.com/security/cve/CVE-2021-3999 ↗
- https://security-tracker.debian.org/tracker/CVE-2021-3999 ↗
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html ↗
- https://security.netapp.com/advisory/ntap-20221104-0001/ ↗
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗