Medium severity · published Mar 26, 2021
CVE-2021-20197
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Binutils · Gnu
through 2.35 · source: NVD
BF
Brocade Fabric Operating System Firmware · Broadcom
All versions, or not specified · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
SH
Solidfire & Hci Management Node · Netapp
All versions, or not specified · source: NVD
Affected product
BF
Brocade Fabric Operating System Firmware
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20197
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20197
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1913743
Third Party Advisory
https://security.gentoo.org/glsa/202208-30
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210528-0009/
Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=26945
More from Brocade Fabric Operating System Firmware
9.0
CVE-2021-40438
mod_proxy SSRF
8.8
CVE-2023-27534
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…
7.8
CVE-2021-4197
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process…
7.5
CVE-2021-36160
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS)
7.5
CVE-2021-34798
Malformed requests may cause the server to dereference a NULL pointer