CVE-2021-35942

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input.(CVE-2021-35942)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Arbitrary read in wordexp() (CVE-2021-35942)

• glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645)

• glibc: mq_notify does not handle separately allocated thread attributes (CVE-2021-33574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Arbitrary read in wordexp() (CVE-2021-35942)

• glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645)

• glibc: mq_notify does not handle separately allocated thread attributes (CVE-2021-33574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Adopt pthread_attr_copy functionality, test case is included
• CVE-2021-33574: avoid use-after-free vulnerability
• CVE-2021-35942: avoid out-of-bounds read via signed integer overflow in array index
• CVE-2021-38604: considered. No NULL pointer dereference is possible

• Adopt pthread_attr_copy functionality, test case is included
• CVE-2021-33574: avoid use-after-free vulnerability
• CVE-2021-35942: avoid out-of-bounds read via signed integer overflow in array index
• CVE-2021-38604: considered. No NULL pointer dereference is possible

• debian/patches/any/add-pthread-attr-copy.patch: adopt pthread_attr_copy functionality.
• debian/patches/any/add-test-for-pthread-attr-copy.patch: add test case for it.
• SECURITY UPDATE: Use-after-free in mq_notify
  • debian/patches/any/CVE-2021-33574.patch: use __pthread_attr_copy to completely duplicate thread attribute, avoid NULL pointer dereference in helper_thread as per CVE-2021-38604.
  • CVE-2021-33574
  • CVE-2021-38604
• SECURITY UPDATE: Out-of-bounds read in wordexp
  • debian/patches/any/CVE-2021-35942.patch: use strtoul and 'unsigned long' to prevent signed integer overflow in array index.
  • CVE-2021-35942

• debian/patches/any/add-pthread-attr-copy.patch: adopt pthread_attr_copy functionality.
• debian/patches/any/add-test-for-pthread-attr-copy.patch: add test case for it.
• SECURITY UPDATE: Use-after-free in mq_notify
  • debian/patches/any/CVE-2021-33574.patch: use __pthread_attr_copy to completely duplicate thread attribute, avoid NULL pointer dereference in helper_thread as per CVE-2021-38604.
  • CVE-2021-33574
  • CVE-2021-38604
• SECURITY UPDATE: Out-of-bounds read in wordexp
  • debian/patches/any/CVE-2021-35942.patch: use strtoul and 'unsigned long' to prevent signed integer overflow in array index.
  • CVE-2021-35942

• CVE-2021-27645: nscd: Fix double free in netgroupcache (#1927877)
• CVE-2021-33574: Deep copy pthread attribute in mq_notify (#1966472)
• CVE-2021-35942: wordexp: handle overflow in positional parameter number (#1979127)
• librt: fix NULL pointer dereference (#1966472)

• CVE-2021-3999: getcwd - Set errno to ERANGE for size == 1
• CVE-2021-35942: wordexp - handle overflow in positional parameter number
• CVE-2022-23218: Buffer overflow in sunrpc svcunix_create
• CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix"

• CVE-2021-35942: fix integer overflow in wordexp positional parameter number

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input (CVE-2021-35942).

This update for glibc fixes the following issues:

• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)

This update was imported from the SUSE:SLE-15:Update update project.

This update for glibc fixes the following issues:

• CVE-2021-33574: Fixed use __pthread_attr_copy in mq_notify (bsc#1186489).
• CVE-2021-35942: Fixed wordexp handle overflow in positional parameter number (bsc#1187911).

These are all security issues fixed in the glibc-2.38-6.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)
• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2021-35942: wordexp: Fixed handle overflow in positional parameter number (bsc#1187911)
• CVE-2016-10228: Rewrite iconv option parsing (bsc#1027496)

Other fixes:

• Fixed race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)

Also the following bug was fixed:

• Avoid concurrency problem in ldconfig (bsc#1117993)

This update for glibc fixes the following issues:

• CVE-2021-33574: Fixed use __pthread_attr_copy in mq_notify (bsc#1186489).
• CVE-2021-35942: Fixed wordexp handle overflow in positional parameter number (bsc#1187911).

This update for glibc fixes the following issues:

• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-6096)

It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-35942)

It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10. (CVE-2021-3998)

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3999)

It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2022-23218, CVE-2022-23219)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. (CVE-2021-3326)

It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2021-35942)