Reachable Assertion in GNU C Library (glibc) - CVE-2021-3326

Vulnerability identifier: #VU50075

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3326

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the iconv function in the GNU C Library (aka glibc or libc6) when processing invalid input sequences in the ISO-2022-JP-3 encoding. A remote attacker can pass specially crafted data to the application, trigger an assertion failure and crash the affected application.

GNU C Library (glibc)
Arch Linux
Gentoo Linux
SUSE Linux Enterprise Server 11
SUSE Manager Server
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
SIMATIC S7-1500 TM MFP - BIOS
Fujitsu M12-2S
Fujitsu M12-2
Fujitsu M12-1
BIG-IP DDHD
BIG-IP
BIG-IP SSLO
Fujitsu M10-1
Fujitsu M10-4
Fujitsu M10-4S
cflinuxfs3
Red Hat OpenShift Serverless
Windows Container Support for Red Hat OpenShift
OpenShift Virtualization
Service Telemetry Framework
Netcool Operations Insight
IBM Cloud Transformation Advisor
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Cloud Pak for Security (CP4S)
RecoverPoint for Virtual Machines
Red Hat OpenShift Jaeger
IBM Security Verify Access
BIG-IP AAM
BIG-IP DNS
BIG-IP Link Controller
Dell EMC VxRail Appliance
BIG-IP FPS
BIG-IP AFM
BIG-IP ASM
BIG-IP LTM
BIG-IP APM
BIG-IP Analytics
BIG-IP GTM
BIG-IP PEM
BIG-IP Advanced WAF
libc6 (Ubuntu package)
glibc-html
glibc-devel
glibc-debuginfo-32bit
nscd
glibc
glibc-profile
glibc-i18ndata
glibc-locale
glibc-info
glibc-locale-32bit
glibc-devel-32bit
glibc-32bit
glibc-debuginfo
glibc-profile-32bit
glibc-debugsource
glibc-devel-debuginfo
glibc-devel-debuginfo-32bit
glibc-locale-debuginfo
glibc-locale-debuginfo-32bit
nscd-debuginfo
glibc-utils-debuginfo
glibc-extra-debuginfo
glibc-utils
glibc-locale-base-debuginfo
glibc-locale-base
glibc-extra
glibc-devel-static
glibc-utils-src-debugsource
glibc-locale-base-32bit-debuginfo
glibc-locale-base-32bit
glibc-devel-32bit-debuginfo
glibc-32bit-debuginfo
glibc-help
glibc-benchtests
nss_modules
glibc-locale-source
libnsl
glibc-debugutils
glibc-common
glibc-all-langpacks
glibc-nss-devel
glibc (Red Hat package)
Web Terminal
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

cflinuxfs3 - update to 0.275.0
Red Hat OpenShift Serverless - update to 1.16.0
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Windows Container Support for Red Hat OpenShift - update to 2.0.1
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
libc6 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.27-3ubuntu1.5, 2.31-0ubuntu9.7, 2.34-0ubuntu3.2
Web Terminal - update to 1.3
Netcool Operations Insight - update to 1.6.8
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
glibc-html - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1
glibc-devel - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-debuginfo-32bit - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1
nscd - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-profile - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-i18ndata - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-locale - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-info - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-locale-32bit - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1
glibc-devel-32bit - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-32bit - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-debuginfo - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-profile-32bit - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1
glibc-debugsource - addressed in versions 2.11.3-17.110.43.1, 2.22-126.1, 2.26-13.56.1
glibc-devel-debuginfo - addressed in versions 2.22-126.1, 2.26-13.56.1
glibc-devel-debuginfo-32bit - update to 2.22-126.1
glibc-locale-debuginfo - update to 2.22-126.1
glibc-locale-debuginfo-32bit - update to 2.22-126.1
nscd-debuginfo - addressed in versions 2.22-126.1, 2.26-13.56.1
glibc-utils-debuginfo - update to 2.26-13.56.1
glibc-extra-debuginfo - update to 2.26-13.56.1
glibc-utils - update to 2.26-13.56.1
glibc-locale-base-debuginfo - update to 2.26-13.56.1
glibc-locale-base - update to 2.26-13.56.1
glibc-extra - update to 2.26-13.56.1
glibc-devel-static - update to 2.26-13.56.1
glibc-utils-src-debugsource - update to 2.26-13.56.1
glibc-locale-base-32bit-debuginfo - update to 2.26-13.56.1
glibc-locale-base-32bit - update to 2.26-13.56.1
glibc-devel-32bit-debuginfo - update to 2.26-13.56.1
glibc-32bit-debuginfo - update to 2.26-13.56.1
glibc-help - update to 2.28-63
glibc-benchtests - update to 2.28-63
nss_modules - update to 2.28-63
glibc-locale-source - update to 2.28-63
libnsl - update to 2.28-63
glibc-debuginfo - update to 2.28-63
glibc - update to 2.28-63
glibc-debugsource - update to 2.28-63
glibc-debugutils - update to 2.28-63
nscd - update to 2.28-63
glibc-devel - update to 2.28-63
glibc-common - update to 2.28-63
glibc-all-langpacks - update to 2.28-63
glibc-nss-devel - update to 2.28-63
glibc (Red Hat package) - update to 2.28-151.el8
IBM Cloud Transformation Advisor - update to 3.10.0
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC VxRail Appliance - update to 7.0.240

• https://sourceware.org/bugzilla/show_bug.cgi?id=27256
• https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888

• Denial of service in glibc
• Arch Linux update for glibc
• Arch Linux update for lib32-glibc
• Denial of service in BIG-IP glibc implementation
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Windows Container Support for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Gentoo update for glibc
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Red Hat Web Terminal
• Multiple vulnerabilities in Dell EMC Unity
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Fujitsu M12-2S
• Multiple vulnerabilities in Fujitsu M12-2
• Multiple vulnerabilities in Fujitsu M12-1
• Multiple vulnerabilities in Fujitsu M10-4S
• Multiple vulnerabilities in Fujitsu M10-4
• Multiple vulnerabilities in Fujitsu M10-1
• Multiple vulnerabilities in Cloud Foundry cflinuxfs3
• SUSE update for glibc
• Ubuntu update for glibc
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in IBM Cloud Pak for Security
• SUSE update for glibc
• Ubuntu update for glibc
• Red Hat Enterprise Linux 8 update for glibc
• SUSE update for glibc
• Multiple vulnerabilities in Siemens SIMATIC S7-1500 TM MFP - BIOS
• Multiple vulnerabilities in IBM Netcool Operations Insight
• SUSE update for glibc
• openEuler update for glibc
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Dell RecoverPoint for Virtual Machines update for third-party components