Cyber Resilience

CVE-2021-3999

HighPublic PoC

Published: 24 August 2022

Published
24 August 2022
Modified
02 December 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0085 75.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-3999 is a high-severity Off-by-one Error (CWE-193) vulnerability in Debian Debian Linux. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed…

more

to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

CWE(s)
CWE-193

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gnu
glibc
≤ 2.31
debian
debian linux
10.0, 11.0
netapp
e-series performance analyzer
all versions
netapp
nfs plug-in
all versions
netapp
ontap select deploy administration utility
all versions
netapp
h300s firmware
all versions
netapp
h500s firmware
all versions
netapp
h700s firmware
all versions
netapp
h410s firmware
all versions
netapp
h410c firmware
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References