Moderate: glibc security, bug fix, and enhancement update
Summary
ALSA-2021:4358: Moderate: glibc security, bug fix, and enhancement update. Affects compat-libpthread-nonshared versions < 2.28-164.el8. Fixed in 2.28-164.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.
Vulnerability Detail
This update addresses multiple security vulnerabilities in glibc:
-
Arbitrary read in wordexp() (CVE-2021-35942): This vulnerability could allow an attacker to read arbitrary memory locations, potentially leading to the disclosure of sensitive information.
-
Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645): This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by manipulating netgroup cache entries.
-
mq_notify does not handle separately allocated thread attributes (CVE-2021-33574): This vulnerability could allow an attacker to crash the application or potentially execute arbitrary code by exploiting a race condition.
For more details about these vulnerabilities, including their impact and CVSS scores, refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
2.28-164.el8
This is the first release that contains the fix.
sudo dnf update compat-libpthread-nonsharedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in glibc. It is recommended to update the glibc packages to the fixed versions to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for compat-libpthread-nonshared →
FAQ
glibc is the GNU C Library, which provides essential C libraries and services for the Linux system.
These vulnerabilities could allow an attacker to read arbitrary memory, execute arbitrary code, cause a denial of service, or potentially gain unauthorized access to sensitive information.
There are no known exploits for these vulnerabilities at the time of this advisory.
There is no known workaround for these vulnerabilities. It is recommended to update the glibc packages to the fixed versions.
You can find more information about these vulnerabilities, including their CVE pages, in the References section of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for compat-libpthread-nonshared.
