CVE-2021-37600
MEDIUMutil-linux < 2.37.1 - Integer Overflow in /proc/sysvipc/sem Handling
Title source: llmDescription
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
References (5)
Core 5
Core References
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202401-08
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html
Patch, Third Party Advisory
https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c
Exploit, Issue Tracking, Third Party Advisory
https://github.com/karelzak/util-linux/issues/1395
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210902-0002/
Scores
CVSS v3
5.5
EPSS
0.0004
EPSS Percentile
12.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-190
Status
published
Products (2)
kernel/util-linux
< 2.37.1
netapp/ontap_select_deploy_administration_utility
Published
Jul 30, 2021
Tracked Since
Feb 18, 2026