Patchwire CVEs, their patch status, and feeds to follow them

CVE-2021-20197

Fixed in a distro release EPSS <1%CVSS 6.3

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Published 2021-03-26 · CVE record · OSV

Products: gnu binutils, redhat enterprise_linux, netapp cloud_backup, netapp ontap_select_deploy_administration_utility, netapp solidfire_&_hci_management_node, broadcom brocade_fabric_operating_system_firmware

Distro releases

ReleasePackageFixed in
AlmaLinux 8binutils-devel2.30-108.el8
Arch Linuxbinutils2.38-1
Debian 12binutils2.37-3
Debian 13binutils2.37-3
Debian 14binutils2.37-3
Red Hat Enterprise Linux 8binutils0:2.30-108.el8
Red Hat Enterprise Linux 8binutils-debuginfo0:2.30-108.el8
Red Hat Enterprise Linux 8binutils-debugsource0:2.30-108.el8
Red Hat Enterprise Linux 8binutils-devel0:2.30-108.el8
Rocky Linux 8binutils0:2.30-108.el8
SUSE Enterprise Storage 6binutils2.37-7.21.2
SUSE HPE Helion OpenStack 8binutils2.37-9.39.1
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOSbinutils2.37-7.21.2
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSbinutils2.37-7.21.2
SUSE Linux Enterprise High Performance Computing 15-ESPOSbinutils2.37-6.23.1
SUSE Linux Enterprise High Performance Computing 15-LTSSbinutils2.37-6.23.1
SUSE Linux Enterprise Module for Basesystem 15 SP2binutils2.37-7.21.2
SUSE Linux Enterprise Module for Basesystem 15 SP3binutils2.37-7.21.2
SUSE Linux Enterprise Module for Development Tools 15 SP2binutils2.37-7.21.2
SUSE Linux Enterprise Module for Development Tools 15 SP3binutils2.37-7.21.2
SUSE Linux Enterprise Module for Development Tools 15 SP3bpftrace0.11.4-3.2.1
SUSE Linux Enterprise Module for Package Hub 15 SP2binutils2.37-7.21.2
SUSE Linux Enterprise Module for Package Hub 15 SP3binutils2.37-7.21.2
SUSE Linux Enterprise Server 12 SP2-BCLbinutils2.37-9.39.1
SUSE Linux Enterprise Server 12 SP3-BCLbinutils2.37-9.39.1
SUSE Linux Enterprise Server 12 SP3-LTSSbinutils2.37-9.39.1
SUSE Linux Enterprise Server 12 SP4-LTSSbinutils2.37-9.39.1
SUSE Linux Enterprise Server 12 SP5binutils2.37-9.39.1
SUSE Linux Enterprise Server 15 SP1-BCLbinutils2.37-7.21.2
SUSE Linux Enterprise Server 15 SP1-LTSSbinutils2.37-7.21.2
SUSE Linux Enterprise Server 15-LTSSbinutils2.37-6.23.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3binutils2.37-9.39.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4binutils2.37-9.39.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5binutils2.37-9.39.1
SUSE Linux Enterprise Server for SAP Applications 15binutils2.37-6.23.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1binutils2.37-7.21.2
SUSE Linux Enterprise Software Development Kit 12 SP5binutils2.37-9.39.1
SUSE Linux Enterprise Software Development Kit 12 SP5cross-ppc-binutils2.37-9.39.1
SUSE Linux Enterprise Software Development Kit 12 SP5cross-spu-binutils2.37-9.39.1
SUSE OpenStack Cloud 8binutils2.37-9.39.1
SUSE OpenStack Cloud 9binutils2.37-9.39.1
SUSE OpenStack Cloud Crowbar 8binutils2.37-9.39.1
SUSE OpenStack Cloud Crowbar 9binutils2.37-9.39.1
Ubuntu Pro 14.04 LTSbinutilsno fix
Ubuntu Pro 16.04 LTSbinutilsno fix
Ubuntu Pro 18.04 LTSbinutilsno fix
Ubuntu Pro 20.04 LTSbinutilsno fix
openSUSE Leap 15.2binutils2.37-lp152.4.9.1
openSUSE Leap 15.2bpftrace0.11.4-lp152.2.7.1
openSUSE Leap 15.2cross-aarch64-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-arm-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-avr-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-epiphany-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-hppa-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-hppa64-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-i386-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-ia64-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-m68k-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-mips-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-ppc-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-ppc64-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-ppc64le-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-riscv64-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-rx-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-s390-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-s390x-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-sparc-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-sparc64-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-spu-binutils2.37-lp152.4.9.1
openSUSE Leap 15.2cross-xtensa-binutils2.37-lp152.4.9.1
openSUSE Leap 15.3binutils2.37-7.21.2
openSUSE Leap 15.3bpftrace0.11.4-3.2.1
openSUSE Leap 15.3cross-aarch64-binutils2.37-7.21.1
openSUSE Leap 15.3cross-arm-binutils2.37-7.21.1
openSUSE Leap 15.3cross-avr-binutils2.37-7.21.1
openSUSE Leap 15.3cross-epiphany-binutils2.37-7.21.1
openSUSE Leap 15.3cross-hppa-binutils2.37-7.21.1
openSUSE Leap 15.3cross-hppa64-binutils2.37-7.21.1
openSUSE Leap 15.3cross-i386-binutils2.37-7.21.1
openSUSE Leap 15.3cross-ia64-binutils2.37-7.21.1
openSUSE Leap 15.3cross-m68k-binutils2.37-7.21.1
openSUSE Leap 15.3cross-mips-binutils2.37-7.21.1
openSUSE Leap 15.3cross-ppc-binutils2.37-7.21.1
openSUSE Leap 15.3cross-ppc64-binutils2.37-7.21.1
openSUSE Leap 15.3cross-ppc64le-binutils2.37-7.21.1
openSUSE Leap 15.3cross-riscv64-binutils2.37-7.21.1
openSUSE Leap 15.3cross-rx-binutils2.37-7.21.1
openSUSE Leap 15.3cross-s390-binutils2.37-7.21.1
openSUSE Leap 15.3cross-s390x-binutils2.37-7.21.1
openSUSE Leap 15.3cross-sparc-binutils2.37-7.21.1
openSUSE Leap 15.3cross-sparc64-binutils2.37-7.21.1
openSUSE Leap 15.3cross-spu-binutils2.37-7.21.1
openSUSE Leap 15.3cross-x86_64-binutils2.37-7.21.1
openSUSE Tumbleweedbinutils2.37-1.3