CVE-2021-37600

An integer truncation flaw was found in util-linux that potentially causes a buffer overflow if an attacker can use system resources that lead to a large number in the /proc/sysvipc/sem file. The highest threat from this vulnerability is to system availability.

This vulnerability is only present in the 32-bit builds of the util-linux package. The standard 64-bit builds (eg x86_64) are not affected. Red Hat Enterprise Linux 8 is marked "Not Affected" since the impacted package is not available as a 32-bit build.

In order for exploit to be possible the "kernel.sem" limits controlled by sysctl must be raised to an abnormally high number. Default values on Red Hat Enterprise Linux are too low to make exploitation possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.