Search for vulnerabilities
Vulnerability details: VCID-n5ry-gsbb-aaaq
Vulnerability ID VCID-n5ry-gsbb-aaaq
Aliases CVE-2021-3998
Summary A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-125 Out-of-bounds Read
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3998.json
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2021-3998
ssvc Track https://access.redhat.com/security/cve/CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00092 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2021-3998
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=2024633
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2024633
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-3998
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-3998
archlinux High https://security.archlinux.org/AVG-1621
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20221020-0003/
ssvc Track https://security.netapp.com/advisory/ntap-20221020-0003/
cvssv3.1 7.5 https://security-tracker.debian.org/tracker/CVE-2021-3998
ssvc Track https://security-tracker.debian.org/tracker/CVE-2021-3998
cvssv3.1 7.5 https://sourceware.org/bugzilla/show_bug.cgi?id=28770
ssvc Track https://sourceware.org/bugzilla/show_bug.cgi?id=28770
cvssv3.1 7.5 https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
ssvc Track https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
cvssv3.1 7.5 https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
ssvc Track https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
cvssv3.1 7.5 https://www.openwall.com/lists/oss-security/2022/01/24/4
ssvc Track https://www.openwall.com/lists/oss-security/2022/01/24/4
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3998.json
https://access.redhat.com/security/cve/CVE-2021-3998
https://api.first.org/data/v1/epss?cve=CVE-2021-3998
https://bugzilla.redhat.com/show_bug.cgi?id=2024633
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.netapp.com/advisory/ntap-20221020-0003/
https://security-tracker.debian.org/tracker/CVE-2021-3998
https://sourceware.org/bugzilla/show_bug.cgi?id=28770
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=84d2d0fe20bdf94feed82b21b4d7d136db471f03
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ee8d5e33adb284601c00c94687bc907e10aec9bb
https://www.openwall.com/lists/oss-security/2022/01/24/4
AVG-1621 https://security.archlinux.org/AVG-1621
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
CVE-2021-3998 https://nvd.nist.gov/vuln/detail/CVE-2021-3998
USN-5310-1 https://usn.ubuntu.com/5310-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3998.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/security/cve/CVE-2021-3998
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://access.redhat.com/security/cve/CVE-2021-3998
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2024633
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2024633
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3998
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3998
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20221020-0003/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://security.netapp.com/advisory/ntap-20221020-0003/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://security-tracker.debian.org/tracker/CVE-2021-3998
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://security-tracker.debian.org/tracker/CVE-2021-3998
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://sourceware.org/bugzilla/show_bug.cgi?id=28770
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://sourceware.org/bugzilla/show_bug.cgi?id=28770
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.openwall.com/lists/oss-security/2022/01/24/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T14:59:39Z/ Found at https://www.openwall.com/lists/oss-security/2022/01/24/4
Exploit Prediction Scoring System (EPSS)
Percentile 0.23496
EPSS Score 0.00092
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.