Integer overflow in GNU C Library (glibc) - CVE-2021-35942

Vulnerability identifier: #VU55972

CSH Severity: Medium

CVSS v4 BT: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-35942

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information or perform a DoS attack.

The vulnerability exists due to integer overflow in parse_param in posix/wordexp.c in the GNU C Library when called with an untrusted pattern. A remote attacker can pass specially crafted data to the application, trigger integer overflow and read arbitrary memory on the system of perform a denial of service (DoS) attack.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

GNU C Library (glibc)
SIMATIC S7-1500 TM MFP - BIOS
Gentoo Linux
SUSE CaaS Platform
SUSE MicroOS
SUSE Enterprise Storage
SUSE OpenStack Cloud
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for ARM 64
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Fedora
cflinuxfs3
Db2 Rest
Cloud Pak for Network Automation
Watson Studio on Cloud Pak for Data
Cloud Pak for Security (CP4S)
RecoverPoint for Virtual Machines
IBM Cloud Pak System
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Netcool Operations Insight
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Transformation Advisor
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenStack
Traffix SDC
libc6 (Ubuntu package)
glibc-locale-debuginfo
glibc-devel-debuginfo
glibc-profile
nscd
nscd-debuginfo
glibc-32bit
glibc-debuginfo-32bit
glibc-devel-32bit
glibc-devel-debuginfo-32bit
glibc-locale-32bit
glibc-locale-debuginfo-32bit
glibc-profile-32bit
glibc-html
glibc-i18ndata
glibc-devel
glibc
glibc-info
glibc-devel-static
glibc-debugsource
glibc-debuginfo
glibc-locale
glibc-devel-32bit-debuginfo
glibc-utils
glibc-utils-debuginfo
glibc-utils-src-debugsource
glibc-32bit-debuginfo
glibc-extra-debuginfo
glibc-locale-base
glibc-locale-base-debuginfo
glibc-extra
glibc-locale-base-32bit-debuginfo
glibc-locale-base-32bit
glibc-common
glibc-all-langpacks
glibc-debugutils
nss_modules
glibc-nss-devel
libnsl
glibc-locale-source
glibc-benchtests
glibc-help
glibc (Red Hat package)
glibc-lang
sys-libs/glibc
IBM Integrated Analytics System
Red Hat OpenShift Serverless
Dell EMC VxRail Appliance
IBM RackSwitch G7028
IBM RackSwitch G8332
IBM Flex System CN4093 10Gb Converged Scalable Switch
IBM Flex System Fabric EN4093R 10Gb Scalable Switch
IBM Flex System Fabric EN4093 10Gb Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM RackSwitch G8264CS
G8264CS_SI_Fabric_Image
IBM RackSwitch G8264T
IBM RackSwitch G8316
IBM RackSwitch G8124E
IBM RackSwitch G8124
IBM RackSwitch G8264
IBM RackSwitch G8052
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install updates from vendor's website.

GNU C Library (glibc) - update to 2.34
cflinuxfs3 - update to 0.275.0
Cloud Pak for Security (CP4S) - update to 1.10.7.0
IBM Cloud Pak System - update to 2.3.3.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
libc6 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.27-3ubuntu1.5, 2.31-0ubuntu9.7, 2.34-0ubuntu3.2
Db2 Rest - update to 1.0.0.304
IBM Integrated Analytics System - update to 1.0.30.0
Netcool Operations Insight - update to 1.6.8
Red Hat OpenShift Serverless - update to 1.20.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
Cloud Pak for Network Automation - update to 2.6.4
glibc-locale-debuginfo - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-devel-debuginfo - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-profile - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
nscd - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
nscd-debuginfo - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-debuginfo-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-devel-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-debuginfo-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-locale-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-locale-debuginfo-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-profile-32bit - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-html - addressed in versions 2.22-114.12.1, 2.22-116.1
glibc-i18ndata - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-info - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-static - addressed in versions 2.22-114.12.1, 2.26-13.59.1, 2.31-9.3.2
glibc-debugsource - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-debuginfo - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-locale - addressed in versions 2.22-114.12.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-32bit-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-utils - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-utils-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-utils-src-debugsource - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-32bit-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-extra-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-extra - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base-32bit-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base-32bit - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-common - update to 2.28-73
glibc-debuginfo - update to 2.28-73
glibc-devel - update to 2.28-73
glibc-all-langpacks - update to 2.28-73
glibc-debugsource - update to 2.28-73
glibc-debugutils - update to 2.28-73
nss_modules - update to 2.28-73
glibc-nss-devel - update to 2.28-73
glibc - update to 2.28-73
libnsl - update to 2.28-73
glibc-locale-source - update to 2.28-73
nscd - update to 2.28-73
glibc-benchtests - update to 2.28-73
glibc-help - update to 2.28-73
glibc (Red Hat package) - update to 2.28-164.el8
glibc-lang - update to 2.31-9.3.2
glibc - addressed in versions 2.32-10.fc33, 2.33-20.fc34
sys-libs/glibc - update to 2.34
IBM Cloud Transformation Advisor - update to 3.10.0
Red Hat Advanced Cluster Security for Kubernetes - update to 3.67
Dell EMC VxRail Appliance - update to 4.7.533
Watson Studio on Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
IBM RackSwitch G7028 - update to 7.6.12.0
IBM RackSwitch G8332 - update to 7.7.40.0
IBM Flex System CN4093 10Gb Converged Scalable Switch - update to 7.8.32.0
IBM Flex System Fabric EN4093R 10Gb Scalable Switch - update to 7.8.32.0
IBM Flex System Fabric EN4093 10Gb Scalable Switch - update to 7.8.32.0
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch - update to 7.8.32.0
IBM Flex System EN2092 1Gb Ethernet Scalable Switch - update to 7.8.32.0
IBM RackSwitch G8264CS - update to 7.8.32.0
G8264CS_SI_Fabric_Image - update to 7.8.32.0
IBM RackSwitch G8264T - update to 7.9.34.0
IBM RackSwitch G8316 - update to 7.9.34.0
IBM RackSwitch G8124E - update to 7.11.24.0
IBM RackSwitch G8124 - update to 7.11.24.0
IBM RackSwitch G8264 - update to 7.11.24.0
IBM RackSwitch G8052 - update to 7.11.24.0
Red Hat OpenStack - update to 16.2

• https://sourceware.org/bugzilla/show_bug.cgi?id=28011
• https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
• https://sourceware.org/glibc/wiki/Security%20Exceptions

• Integer overflow in GNU C Library
• Integer overflow in glibc component in Traffix SDC
• SUSE Linux Enterprise Server 11 update for glibc
• Integer overflow in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Cloud Foundry cflinuxfs3
• Integer overflow in IBM Flex System switch firmware products
• Integer overflow in IBM RackSwitch firmware products
• SUSE update for glibc
• SUSE update for glibc
• SUSE update for glibc
• SUSE update for glibc
• Ubuntu update for glibc
• Gentoo update for GNU C Library
• Multiple vulnerabilities in IBM Cloud Pak System third-party components
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Ubuntu update for glibc
• Red Hat Enterprise Linux 8 update for glibc
• Multiple vulnerabilities in Siemens SIMATIC S7-1500 TM MFP - BIOS
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• openEuler update for glibc
• Multiple vulnerabilities in IBM Db2 Rest
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• IBM Integrated Analytics System in glibc
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.67
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.20
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Fedora 34 update for glibc
• Fedora 33 update for glibc
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data
• Dell RecoverPoint for Virtual Machines update for third-party components
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2