CVE-2021-35937 Race condition in RPM
A local unprivileged user can exploit a race condition in RPM to bypass security checks and gain root privileges, compromising system integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-35937?
CVE-2021-35937 is a medium-severity vulnerability in Fedoraproject Fedora, published on 25 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Which versions are affected by CVE-2021-35937?
It affects 3 products.
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Rpm Rpm.
How do I fix CVE-2021-35937?
Apply the vendor's patch.
Is CVE-2021-35937 being exploited?
There is no known exploitation of CVE-2021-35937 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-10766, CLSA-2024-1721124363, CLSA-2024-1721124939, DEBIAN-CVE-2021-35937, GHSA-63x9-9q4w-j636, UBUNTU-CVE-2021-35937.