CVE-2021-3999

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)

• glibc: Stack-based buffer overflow in svcunix_create via long pathnames (CVE-2022-23218)

• glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname (CVE-2022-23219)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)

• glibc: Stack-based buffer overflow in svcunix_create via long pathnames (CVE-2022-23218)

• glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname (CVE-2022-23219)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2021-3999: fix single byte buffer overflow and overflow in getcwd

• CVE-2021-3999: fix single byte buffer overflow and overflow in getcwd

• CVE-2021-3999: single byte buffer overflow and overflow in getcwd

• CVE-2021-3999: single byte buffer overflow and overflow in getcwd

• SECURITY UPDATE: single byte buffer underflow and overflow
  • debian/patches/any/CVE-2021-3999.patch: reject buffer of size 1 and return NULL with errno set to ERANGE
  • CVE-2021-3999

• CVE-2021-3999: getcwd - Set errno to ERANGE for size == 1
• CVE-2021-35942: wordexp - handle overflow in positional parameter number
• CVE-2022-23218: Buffer overflow in sunrpc svcunix_create
• CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix"

Updated glibc packages fix security vulnerability:

An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system (CVE-2021-3999).

Other upstream fixes in this update:

• gconv: Do not emit spurious NUL character in ISO-2022-JP-3 [BZ #28524]
• x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ #28755]
• x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP
• x86-64: Add ifunc-avx2.h functions with 256-bit EVEX
• x86-64: Add strcpy family functions with 256-bit EVEX
• x86-64: Add memmove family functions with 256-bit EVEX
• x86-64: Add memset family functions with 256-bit EVEX
• x86-64: Add memcmp family functions with 256-bit EVEX
• x86-64: Add AVX optimized string/memory functions for RTM
• x86: Add string/memory function tests in RTM region
• x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions
• x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions
• test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655]
• test-strnlen.c: Check that strnlen won't go beyond the maximum length
• x86: Optimize memchr-avx2.S
• x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974]
• x86: Optimize strlen-avx2.S
• x86: Optimize memchr-evex.S
• x86-64: Fix an unknown vector operation in memchr-evex.S
• x86-64: Move strlen.S to multiarch/strlen-vec.S
• x86-64: Add wcslen optimize for sse4.1
• x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974]
• x86: Optimize strlen-evex.S
• String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974]
• x86-64: Require BMI2 for __strlen_evex and __strnlen_evex
• x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033]
• x86: Black list more Intel CPUs for TSX [BZ #27398]
• x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064]
• x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064]

This update for glibc fixes the following issues:

• CVE-2021-3999: Fixed incorrect errno in getcwd (bsc#1194640)
• CVE-2022-23219: Fixed buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
• CVE-2022-23218: Fixed buffer overflow in sunrpc svcunix_create (bsc#1194770)

Features added:

• IBM Power 10 string operation improvements (bsc#1194785, jsc#SLE-18195)

These are all security issues fixed in the glibc-2.35-1.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2021-3999: Fixed incorrect errno in getcwd (bsc#1194640)
• CVE-2022-23219: Fixed buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
• CVE-2022-23218: Fixed buffer overflow in sunrpc svcunix_create (bsc#1194770)

Features added:

• IBM Power 10 string operation improvements (bsc#1194785, jsc#SLE-18195)

glibc was updated to fix the following issues:

Security issues fixed:

• CVE-2021-3999: Fixed incorrect errno in getcwd (bsc#1194640)
• CVE-2022-23219: Fixed buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
• CVE-2022-23218: Fixed buffer overflow in sunrpc svcunix_create (bsc#1194770)

Bugs fixed:

• Make endian-conversion macros always return correct types (bsc#1193478, BZ #16458)
• Allow dlopen of filter object to work (bsc#1192620, BZ #16272)
• x86: fix stack alignment in cancelable syscall stub (bsc#1191835)

glibc was updated to fix the following issues:

Security issues fixed:

• CVE-2022-23219: Fixed Buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
• CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bsc#1194770)
• CVE-2021-3999: Fixed getcwd to set errno to ERANGE for size == 1 (bsc#1194640)
• CVE-2015-8985: Fixed Assertion failure in pop_fail_stack when executing a malformed regexp (bsc#1193625)

Also the following bug was fixed:

• Fix pthread_rwlock_try*lock stalls (bsc#1195560)

This update for glibc fixes the following issues:

• CVE-2022-23219: Fixed buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768)
• CVE-2022-23218: Fixed buffer overflow in sunrpc svcunix_create (bsc#1194770)
• CVE-2021-3999: Fixed getcwd to set errno to ERANGE for size == 1 (bsc#1194640)

This update for glibc fixes the following issues:

• CVE-2022-23219: Fixed buffer overflow in sunrpc clnt_create for 'unix' (bsc#1194768, BZ #22542)
• CVE-2022-23218: Fixed buffer overflow in sunrpc svcunix_create (bsc#1194770, BZ #28768)
• CVE-2021-3999: Fixed in getcwd to set errno to ERANGE for size == 1 (bsc#1194640, BZ #28769)
• CVE-2015-8983: Fixed _IO_wstr_overflow integer overflow (bsc#1193615, BZ #17269)
• CVE-2015-8982: Fixed memory handling in strxfrm_l (bsc#1193616, BZ #16009)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-6096)

It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-35942)

It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10. (CVE-2021-3998)

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3999)

It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2022-23218, CVE-2022-23219)

USN-5310-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3999)

It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2022-23218, CVE-2022-23219)

It was discovered that GNU C Library incorrectly handled netgroup requests. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9984)

It was discovered that GNU C Library might allow context-dependent attackers to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-20109)

It was discovered that GNU C Library when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-11236)

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-3999)

Charles Fol discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-2961)