Medium severity6.4NVD Advisory· Published Aug 25, 2022· Updated Jun 17, 2026
CVE-2021-35937
CVE-2021-35937
Description
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
26- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- osv-coords17 versionspkg:rpm/almalinux/python3-rpmpkg:rpm/almalinux/rpmpkg:rpm/almalinux/rpm-apidocspkg:rpm/almalinux/rpm-buildpkg:rpm/almalinux/rpm-build-libspkg:rpm/almalinux/rpm-cronpkg:rpm/almalinux/rpm-develpkg:rpm/almalinux/rpm-libspkg:rpm/almalinux/rpm-plugin-auditpkg:rpm/almalinux/rpm-plugin-fapolicydpkg:rpm/almalinux/rpm-plugin-imapkg:rpm/almalinux/rpm-plugin-prioresetpkg:rpm/almalinux/rpm-plugin-selinuxpkg:rpm/almalinux/rpm-plugin-syslogpkg:rpm/almalinux/rpm-plugin-systemd-inhibitpkg:rpm/almalinux/rpm-signpkg:rpm/almalinux/rpm-sign-libs
< 4.16.1.3-27.el9_3+ 16 more
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.14.3-28.el8_9
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
- (no CPE)range: < 4.16.1.3-27.el9_3
Patches
Vulnerability mechanics
References
5- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchVendor Advisory
- www.usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdfnvdExploitTechnical DescriptionThird Party Advisory
- access.redhat.com/security/cve/CVE-2021-35937nvdVendor Advisory
- security.gentoo.org/glsa/202210-22nvdThird Party Advisory
- rpm.org/wiki/Releases/4.18.0nvdRelease Notes
News mentions
0No linked articles in our index yet.