CVE-2021-37600

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

References

https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c

https://github.com/karelzak/util-linux/issues/1395

https://security.netapp.com/advisory/ntap-20210902-0002/

Details

Source: MITRE

Published: 2021-07-30

Updated: 2021-09-24

Type: CWE-190

Risk Information

CVSS v2

Base Score: 1.2

Vector: AV:L/AC:H/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 1.9

Severity: LOW

CVSS v3

Base Score: 5.5

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 1.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:* versions up to 2.37.1 (inclusive)

Tenable Plugins

View all (4 total)

IDNameProductFamilySeverity
152789Photon OS 2.0: Util PHSA-2021-2.0-0379NessusPhotonOS Local Security Checks
medium
152787Photon OS 1.0: Util PHSA-2021-1.0-0424NessusPhotonOS Local Security Checks
medium
152786Photon OS 4.0: Util PHSA-2021-4.0-0081NessusPhotonOS Local Security Checks
medium
152557Photon OS 3.0: Util PHSA-2021-3.0-0283NessusPhotonOS Local Security Checks
medium