ZeroDay Findings
Sign inSign up

Findings

CVE-2021-3999

A flaw was found in glibc.

Published Aug 24, 2022 · updated Oct 14, 2026 · gnu glibc

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2022 · NIST NVD

    Detected

    A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe gnu/glibcversion unspecified
  • cpe netapp/e-series performance analyzerversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410c firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/nfs plug-inversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified

Sources

  • CVE.orgCVE-2021-3999

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-3999

    30-day exploitation probability 0.8%

    first.org
  • NIST NVDCVE-2021-3999

    A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to pote

    nvd.nist.gov

References