Skip to content
Fencer Vulns
medium 6.7

CVE-2021-35938 json

A symbolic link issue was found in rpm.

published 2022-08-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-22573

cvss
6.7
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

  • rpm rpm 4.18.0
  • rpm Debian 14, Debian 13 4.18.2+dfsg-1

debian advisories DEBIAN-CVE-2021-35938

  • rpm RHEL 8 4.14.3-28.el8_9
  • rpm-cron RHEL 8 4.14.3-28.el8_9
  • rpm-libs RHEL 8 4.14.3-28.el8_9
  • rpm-sign RHEL 8 4.14.3-28.el8_9
  • rpm-build RHEL 8 4.14.3-28.el8_9
  • python3-rpm RHEL 8 4.14.3-28.el8_9
  • rpm-apidocs RHEL 8 4.14.3-28.el8_9
  • rpm-build-libs RHEL 8 4.14.3-28.el8_9

red hat advisories RHSA-2024:0582RHSA-2024:0453RHSA-2024:0424RHSA-2024:0647RHSA-2024:0463RHSA-2024:0435

  • rpm openSUSE Tumbleweed 4.18.0-1.1

opensuse advisories openSUSE-SU-2024:12562-1

  • rpm AlmaLinux 8 4.14.3-28.el8_9
  • rpm-cron AlmaLinux 8 4.14.3-28.el8_9
  • rpm-libs AlmaLinux 8 4.14.3-28.el8_9
  • rpm-sign AlmaLinux 8 4.14.3-28.el8_9
  • rpm-build AlmaLinux 8 4.14.3-28.el8_9
  • python3-rpm AlmaLinux 8 4.14.3-28.el8_9
  • rpm-apidocs AlmaLinux 8 4.14.3-28.el8_9
  • rpm-build-libs AlmaLinux 8 4.14.3-28.el8_9

almalinux advisories ALSA-2024:0647ALSA-2024:0463

  • rpm Rocky Linux 8 4.14.3-28.el8_9

rocky linux advisories RLSA-2024:0647

  • rpm Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 4.18.0-r0

alpine advisories ALPINE-CVE-2021-35938

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rpm CBL-Mariner 2.0 4.18.0-1

azure linux advisories AZL-10723

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-35938 updated cvss 6.5

rpm: races with chown/chmod/capabilities calls during installation

  • Red Hat Enterprise Linux 6 rpm, rpm-cron, rpm-libs, rpm-build, rpm-python, rpm-apidocs Red Hat Enterprise Linux 7 rpm, rpm-cron, rpm-libs, rpm-sign, rpm-build, rpm-python, +3 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) rpm 4.14.3-28.el8_9, rpm-cron 4.14.3-28.el8_9, rpm-libs 4.14.3-28.el8_9, rpm-sign 4.14.3-28.el8_9, rpm-build 4.14.3-28.el8_9, python3-rpm 4.14.3-28.el8_9, +8 more
    fixed: vendor fix RHSA-2024:0647
  • Red Hat Enterprise Linux AppStream (v. 9) rpm 4.16.1.3-27.el9_3, rpm-cron 4.16.1.3-27.el9_3, rpm-libs 4.16.1.3-27.el9_3, rpm-sign 4.16.1.3-27.el9_3, rpm-build 4.16.1.3-27.el9_3, python3-rpm 4.16.1.3-27.el9_3, +9 more
    fixed: vendor fix RHSA-2024:0463
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) rpm 4.14.3-26.el8_6, rpm-cron 4.14.3-26.el8_6, rpm-libs 4.14.3-26.el8_6, rpm-sign 4.14.3-26.el8_6, rpm-build 4.14.3-26.el8_6, python3-rpm 4.14.3-26.el8_6, +8 more
    fixed: vendor fix RHSA-2024:0424
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) rpm 4.14.3-28.el8_8, rpm-cron 4.14.3-28.el8_8, rpm-libs 4.14.3-28.el8_8, rpm-sign 4.14.3-28.el8_8, rpm-build 4.14.3-28.el8_8, python3-rpm 4.14.3-28.el8_8, +8 more
    fixed: vendor fix RHSA-2024:0582
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) rpm 4.16.1.3-14.el9_0.1, rpm-cron 4.16.1.3-14.el9_0.1, rpm-libs 4.16.1.3-14.el9_0.1, rpm-sign 4.16.1.3-14.el9_0.1, rpm-build 4.16.1.3-14.el9_0.1, python3-rpm 4.16.1.3-14.el9_0.1, +9 more
    fixed: vendor fix RHSA-2024:0435
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) rpm 4.16.1.3-24.el9_2, rpm-cron 4.16.1.3-24.el9_2, rpm-libs 4.16.1.3-24.el9_2, rpm-sign 4.16.1.3-24.el9_2, rpm-build 4.16.1.3-24.el9_2, python3-rpm 4.16.1.3-24.el9_2, +9 more
    fixed: vendor fix RHSA-2024:0453
  • Red Hat Enterprise Linux BaseOS (v. 8) rpm 4.14.3-28.el8_9, rpm-cron 4.14.3-28.el8_9, rpm-libs 4.14.3-28.el8_9, rpm-sign 4.14.3-28.el8_9, rpm-build 4.14.3-28.el8_9, python3-rpm 4.14.3-28.el8_9, +8 more
    fixed: vendor fix RHSA-2024:0647
show 7 more
  • Red Hat Enterprise Linux BaseOS (v. 9) rpm 4.16.1.3-27.el9_3, rpm-cron 4.16.1.3-27.el9_3, rpm-libs 4.16.1.3-27.el9_3, rpm-sign 4.16.1.3-27.el9_3, rpm-build 4.16.1.3-27.el9_3, python3-rpm 4.16.1.3-27.el9_3, +9 more
    fixed: vendor fix RHSA-2024:0463
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) rpm 4.14.3-26.el8_6, rpm-cron 4.14.3-26.el8_6, rpm-libs 4.14.3-26.el8_6, rpm-sign 4.14.3-26.el8_6, rpm-build 4.14.3-26.el8_6, python3-rpm 4.14.3-26.el8_6, +8 more
    fixed: vendor fix RHSA-2024:0424
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) rpm 4.14.3-28.el8_8, rpm-cron 4.14.3-28.el8_8, rpm-libs 4.14.3-28.el8_8, rpm-sign 4.14.3-28.el8_8, rpm-build 4.14.3-28.el8_8, python3-rpm 4.14.3-28.el8_8, +8 more
    fixed: vendor fix RHSA-2024:0582
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) rpm 4.16.1.3-14.el9_0.1, rpm-cron 4.16.1.3-14.el9_0.1, rpm-libs 4.16.1.3-14.el9_0.1, rpm-sign 4.16.1.3-14.el9_0.1, rpm-build 4.16.1.3-14.el9_0.1, python3-rpm 4.16.1.3-14.el9_0.1, +9 more
    fixed: vendor fix RHSA-2024:0435
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) rpm 4.16.1.3-24.el9_2, rpm-cron 4.16.1.3-24.el9_2, rpm-libs 4.16.1.3-24.el9_2, rpm-sign 4.16.1.3-24.el9_2, rpm-build 4.16.1.3-24.el9_2, python3-rpm 4.16.1.3-24.el9_2, +9 more
    fixed: vendor fix RHSA-2024:0453
  • Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-rhel9-operator 8.1.2-13, openshift4-wincw/windows-machine-config-operator-bundle v8.1.2-13
    fixed: vendor fix RHSA-2024:1477
  • Red Hat RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9 v4.15.0-37, odf4/odf-cli-rhel9 v4.15.0-22, odf4/mcg-core-rhel9 v4.15.0-68, odf4/odf-console-rhel9 v4.15.0-57, odf4/mcg-rhel9-operator v4.15.0-39, odf4/ocs-rhel9-operator v4.15.0-79, +20 more
    fixed: vendor fix RHSA-2024:1383

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1157880 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • n/a RPM

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.