A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
The product reads data past the end, or before the beginning, of the intended buffer.
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
| Link | Tags |
|---|---|
| https://www.openwall.com/lists/oss-security/2022/01/24/4 | mailing list patch third party advisory |
| https://sourceware.org/bugzilla/show_bug.cgi?id=28770 | issue tracking patch third party advisory |
| https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb | |
| https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2024633 | issue tracking patch third party advisory |
| https://access.redhat.com/security/cve/CVE-2021-3998 | third party advisory |
| https://security-tracker.debian.org/tracker/CVE-2021-3998 | third party advisory |
| https://security.netapp.com/advisory/ntap-20221020-0003/ | third party advisory |