CVE-2021-37600

MEDIUM
Published Jul 30, 20214y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jul 30, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 2

VendorProductVersionRange
kernelutil-linux* ≤2.37.1
netappontap_select_deploy_administration_utility*any

References 5

  • github.com https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c
    PatchThird Party Advisory
  • github.com https://github.com/karelzak/util-linux/issues/1395
    ExploitIssue TrackingThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html
  • security.gentoo.org https://security.gentoo.org/glsa/202401-08
  • security.netapp.com https://security.netapp.com/advisory/ntap-20210902-0002/
    Third Party Advisory

Remediation

  • github.com https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c
    PatchThird Party Advisory