A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
The product reads data past the end, or before the beginning, of the intended buffer.
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
| Link | Tags |
|---|---|
| https://www.openwall.com/lists/oss-security/2022/01/24/4 | mailing list third party advisory patch |
| https://sourceware.org/bugzilla/show_bug.cgi?id=28770 | issue tracking third party advisory patch |
| https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb | |
| https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2024633 | issue tracking third party advisory patch |
| https://access.redhat.com/security/cve/CVE-2021-3998 | third party advisory |
| https://security-tracker.debian.org/tracker/CVE-2021-3998 | third party advisory |
| https://security.netapp.com/advisory/ntap-20221020-0003/ | third party advisory |