A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.8 · gnu, debian, netappNVD modified 2026-10-14 10:17
Affected (CPE criteria) 11
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:nfs_plug-in:*:*:*:*:*:vmware_vaai:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
References 18
- https://access.redhat.com/security/cve/CVE-2021-3999 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2024637 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing List, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-3999 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221104-0001/ Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=28769 Issue Tracking, Third Party Advisory
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
- https://www.openwall.com/lists/oss-security/2022/01/24/4 Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-3999 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2024637 Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing List, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-3999 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221104-0001/ Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=28769 Issue Tracking, Third Party Advisory
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
- https://www.openwall.com/lists/oss-security/2022/01/24/4 Exploit, Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html