#VU79523 Link following in rpm - CVE-2021-35939

Vulnerability identifier: #VU79523

Vulnerability risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-35939

CWE-ID: CWE-59

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
rpm

Vendor: rpm-software-management

Description

The vulnerability allows a local privileged user to escalate privileges on the system.

The vulnerability exist due to fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local privileged user who owns another ancestor directory could potentially use this flaw to gain root privileges.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

rpm: before 4.18.0

---

External links
https://github.com/rpm-software-management/rpm/pull/1919
https://bugzilla.redhat.com/show_bug.cgi?id=1964129
https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556
https://access.redhat.com/security/cve/CVE-2021-35939
https://rpm.org/wiki/Releases/4.18.0
https://security.gentoo.org/glsa/202210-22

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.