Skip to content
fr Sign in
6.3 Medium

CVE-2021-20197 There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar,…

Description

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Affected products and versions

Product Affected versions Fixed in
binutils Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of binutils

The 17 CVEs of binutils →
CVE-2023-25584 An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils 6.3 Medium CVE-2023-25585 A flaw was found in Binutils 4.7 Medium CVE-2023-25586 A flaw was found in Binutils 4.7 Medium CVE-2023-25588 A flaw was found in Binutils 4.7 Medium
Track this CVE