MEDIUM 6.3 Microsoft

CVE-2021-20197

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar objcopy strip ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users) an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Microsoft Security Update 2021-Mar: There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar objcopy strip ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users) an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Affected Products

References

Published: 2021-03-09 · Source: Microsoft · Feed updated: 2026-08-20
This medium severity vulnerability with a CVSS score of 6.3 was published on 2021-03-09 via Microsoft. Affected: azl3 crash 8.0.4-3 on Azure Linux 3.0, azl3 crash 8.0.4-4 on Azure Linux 3.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.