binutils: Race window allows users to own arbitrary files
Published Mar 26, 2021
6.3
MEDIUMCVSS 3.1
EPSS 0.30%
Description
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.
Affected products
- Vendor n/a Product Binutils Defaultn/a
- Version binutils 2.35StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Binutils | n/a |
|
Configuration 2
- 8.0
Configuration 3
- n/a
- n/a
- n/a
- n/a
No data.
Red Hat Enterprise Linux 8
binutils-0:2.30-108.el8
Fixed · RHSA-2021:4364
Red Hat Enterprise Linux 8
binutils-0:2.30-108.el8
Fixed · RHSA-2021:4364
Red Hat Enterprise Linux 6
binutils
Out of support scope
Red Hat Enterprise Linux 7
binutils
Out of support scope
Red Hat Enterprise Linux 8
gcc-toolset-10-binutils
Fix deferred
Red Hat Enterprise Linux 8
gcc-toolset-9-binutils
Affected
Red Hat Enterprise Linux 9
binutils
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | binutils-0:2.30-108.el8 | Fixed | RHSA-2021:4364 |
| Red Hat Enterprise Linux 8 | binutils-0:2.30-108.el8 | Fixed | RHSA-2021:4364 |
| Red Hat Enterprise Linux 6 | binutils | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | binutils | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | gcc-toolset-10-binutils | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | gcc-toolset-9-binutils | Affected | n/a |
| Red Hat Enterprise Linux 9 | binutils | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (8)
- https://access.redhat.com/security/cve/CVE-2021-20197 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1913743 x_refsource_MISCIssue TrackingPatchThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7643 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-20197
- https://security.gentoo.org/glsa/202208-30 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210528-0009/ x_refsource_CONFIRMThird Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=26945 x_refsource_MISCIssue TrackingPatchThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-20197
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-20197 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1913743 | x_refsource_MISCIssue TrackingPatchThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7643 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2021-20197 | ||
| https://security.gentoo.org/glsa/202208-30 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://security.netapp.com/advisory/ntap-20210528-0009/ | x_refsource_CONFIRMThird Party Advisory | |
| https://sourceware.org/bugzilla/show_bug.cgi?id=26945 | x_refsource_MISCIssue TrackingPatchThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2021-20197 |
Change history (0)
No recorded changes yet.