A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
Se ha encontrado un fallo en glibc. Un desbordamiento y subdesbordamiento de búfer en la función getcwd() puede conllevar a una corrupción de memoria cuando el tamaño del búfer es exactamente 1. Un atacante local que pueda controlar el búfer de entrada y el tamaño pasado a getcwd() en un programa setuid podría usar este fallo para ejecutar potencialmente código arbitrario y escalar sus privilegios en el sistema.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-193
|
| [email protected] | Secondary |
en
CWE-193
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | glibc | * | <built-in method update of dict object at 0x7fd289aff700> | Application |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd39c4a4680> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7fd34118d1c0> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd369406a40> | Operating System |
| netapp | e-series_performance_analyzer | - | <built-in method update of dict object at 0x7fd39c4a4f80> | Application |
| netapp | nfs_plug-in | * | <built-in method update of dict object at 0x7fd39c4a4080> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd3694062c0> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd2dbc452c0> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd2dbc478c0> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd39c4a59c0> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd36960ea80> | Operating System |
| netapp | h410c_firmware | - | <built-in method update of dict object at 0x7fd39c4a4a00> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:nfs_plug-in:*:*:*:*:*:vmware_vaai:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* |