What’s Vulnerable › Vulnerabilities
CVE-2021-3999
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-08-24 · updated 2026-10-14
- Weakness: CWE-193
Description
A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
Affected products
- Debian Linux: 10.0, 11.0
- GNU C Library (glibc): before 2.31 — fixed in 2.31
- NetApp E-Series Performance Analyzer: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Nfs Plug-In: all versions
- NetApp ONTAP Select Deploy administration utility: all versions
How to fix
Upgrade to a fixed version: GNU C Library (glibc) 2.31. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/security/cve/CVE-2021-3999
- https://bugzilla.redhat.com/show_bug.cgi?id=2024637
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security-tracker.debian.org/tracker/CVE-2021-3999
- https://security.netapp.com/advisory/ntap-20221104-0001/
- https://sourceware.org/bugzilla/show_bug.cgi?id=28769
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
- https://www.openwall.com/lists/oss-security/2022/01/24/4
- https://access.redhat.com/security/cve/CVE-2021-3999
- https://bugzilla.redhat.com/show_bug.cgi?id=2024637
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security-tracker.debian.org/tracker/CVE-2021-3999
Get alerted when CVE-2021-3999 or the next vulnerability affects your stack