Medium severity · published Aug 26, 2022
CVE-2021-35939
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created
6.7
CVSS
0.5%
EPSS
No
On KEV
Description
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
8.0 · source: NVD
RP
Rpm · Rpm
before 4.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35939
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-35939
Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=1964129
Patch
https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556
Patch
https://github.com/rpm-software-management/rpm/pull/1919
Release Notes
https://rpm.org/wiki/Releases/4.18.0
Third Party Advisory
https://security.gentoo.org/glsa/202210-22
More from Enterprise Linux
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.0
CVE-2021-40438
mod_proxy SSRF