CVE-2021-35938: Medium severity RPM RPM vulnerability
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
RPM Project RPM could allow a local authenticated attacker to gain elevated privileges on the system, caused by a symbolic link when setting the desired permissions and credentials after installing a file. An attacker could exploit this vulnerability to exchange the original file with a symbolic link to a security-critical file and gain elevated privileges on the system.
— IBM
When RPM installs a file/directory, it uses path-based operations afterwards to set the desired permissions and credentials. When the directory this is happening in is owned by an unprivileged user, that user can escalate privileges to root by exchanging the file/directory with a symbolic link to a security-critical file/directory.
References: https://bugzilla.suse.com/showbug.cgi?id=1157880
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-35938?
CVE-2021-35938 is a symbolic link issue found in rpm, which allows a local unprivileged user to escalate their privileges on the system.
How does CVE-2021-35938 work?
CVE-2021-35938 occurs when rpm sets the desired permissions and credentials after installing a file, allowing a user to exchange the original file with a symbolic link to a security-critical file.
Which software is affected by CVE-2021-35938?
The software affected by CVE-2021-35938 includes rpm version up to 4.18.0, Fedora 34, Red Hat Enterprise Linux 7.0, 8.0, and 9.0.
What is the severity of CVE-2021-35938?
CVE-2021-35938 has a severity rating of medium with a CVSS score of 6.7.
How can I fix CVE-2021-35938?
To fix CVE-2021-35938, update your rpm software to version 4.18.0 or later.