CVE Feed

    Dashboard / CVE / CVE-2021-20197

    CVE-2021-20197

    There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

    Published:Jan 7, 2021
    Last Modified:Dec 3, 2025
    EPS:Mar 26, 2021
    EPSS Score:0.00193
    CVSS Score:6.3

    Affected Products

    Vendor
    Broadcom
    Product
    Brocade Fabric Operating System Firmware
    Vendor
    Gnu
    Product
    Binutils
    Vendor
    Netapp
    Product
    Cloud Backup
    Vendor
    Netapp
    Product
    Ontap Select Deploy Administration Utility
    Vendor
    Netapp
    Product
    Solidfire \& Hci Management Node
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-27538 (CVSS 5.5) — An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously establis…
    CVE-2023-27534 (CVSS 8.8) — A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be …
    CVE-2023-27537 (CVSS 5.9) — A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This s…
    CVE-2021-36160 (CVSS 7.5) — A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (D…
    CVE-2021-40438 (CVSS 9) — A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remot…
    CVE-2021-34798 (CVSS 7.5) — Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2…
    CVE-2021-4197 (CVSS 7.8) — An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem w…
    CVE-2021-28153 (CVSS 5.3) — An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_…
    CVE-2021-27218 (CVSS 7.5) — An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was c…
    CVE-2021-27219 (CVSS 7.5) — An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High