Vulnerability in GNOME GLib: CVE-2021-28153
Summary
CVE-2021-28153: An issue was discovered in GNOME GLib before 2.66.8. Affects glib across 2 version ranges.
< 2.66.6-r0
< dde05fd4fcd1d96d1693723ae1d7f37ecd991215
Fixed in 2.66.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNOME GLib is a library that provides core application building blocks for developers. It offers data structure handling, portability wrappers, and interfaces for various functionalities. The vulnerability identified as CVE-2021-28153 affects versions prior to 2.66.8. This vulnerability arises when the function g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink. In such cases, the function incorrectly creates the target of the symlink as an empty file, which could potentially be exploited by an attacker who controls the symlink. It is important to note that if the path is a symlink to an existing file, the contents of that file remain unchanged.
Vulnerability Detail
The vulnerability in GNOME GLib (CVE-2021-28153) allows an attacker to create an empty file when replacing a path that is a dangling symlink. This could have security implications if the symlink is under the control of the attacker. By exploiting this vulnerability, an attacker could potentially overwrite or tamper with sensitive files, leading to unauthorized access, data loss, or other malicious activities. The impact of this vulnerability depends on the context in which the affected library is used and the permissions of the user running the vulnerable code.
How To Fix
Minimum fixed version
2.66.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade glibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually check and handle symlinks before using the g_file_replace() function. This involves verifying the target of the symlink and ensuring it is not controlled by an attacker. If the symlink is determined to be safe, the function can be used as intended. However, it is strongly recommended to apply the official fix by updating to the patched version of GNOME GLib.
Conclusion
The vulnerability (CVE-2021-28153) in GNOME GLib allows an attacker to create an empty file when replacing a dangling symlink. This could potentially lead to unauthorized access, data loss, or other malicious activities. It is crucial to update to the patched version of GNOME GLib (2.66.8 or later) and ensure that all dependencies and applications using the library are also updated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for glib →
FAQ
GNOME GLib is a library that provides core application building blocks for developers. It offers data structure handling, portability wrappers, and interfaces for various functionalities.
The impact of CVE-2021-28153 depends on the context in which the affected library is used and the permissions of the user running the vulnerable code. It could potentially lead to unauthorized access, data loss, or other malicious activities if exploited by an attacker.
To fix this vulnerability, it is recommended to update GNOME GLib to version 2.66.8 or later. Ensure that all dependencies and applications using GNOME GLib are also updated to utilize the patched version.
As a workaround, users can manually check and handle symlinks before using the g_file_replace() function. However, it is strongly recommended to apply the official fix by updating to the patched version of GNOME GLib.
Users can obtain the patched version of GNOME GLib from the official GNOME website or through their respective package managers.
Related vulnerabilities
Recent vulnerabilities recorded for glib.
