CVE-2021-20197 Race condition in binutils

What is CVE-2021-20197?

CVE-2021-20197 is a medium-severity vulnerability in Gnu Binutils, published on 26 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Weakness: CWE-362, CWE-59

Which versions are affected by CVE-2021-20197?

It affects 6 products.

Products include Broadcom Brocade Fabric Operating System Firmware, Gnu Binutils, Netapp Cloud Backup, Netapp Ontap Select Deploy Administration Utility, Netapp Solidfire \& Hci Management Node, Redhat Enterprise Linux.

How do I fix CVE-2021-20197?

Apply the vendor's patch.

Is CVE-2021-20197 being exploited?

There is no known exploitation of CVE-2021-20197 in the wild and no public exploit code.

Other vulnerabilities in Gnu Binutils

• CVE-2023-27534 Path traversal in https://github.com/curl/curl High 8.8
• CVE-2021-4197 Privilege escalation in kernel High 7.8
• CVE-2023-27538 Auth bypass in https://github.com/curl/curl High 7.7
• CVE-2021-27218 Integer overflow in n/a High 7.5
• CVE-2021-27219 Integer overflow in n/a High 7.5

All Gnu Binutils vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-41714, DEBIAN-CVE-2021-20197, GHSA-rq67-5wpf-96wv, OESA-2021-1153, UBUNTU-CVE-2021-20197.