External risk intelligence

GNU glibc wordexp Integer Overflow Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2021-35942

The vulnerability exists within the GNU C Library (glibc), which is a foundational software component used by countless applications. While the library itself is ubiquitous, the specific function wordexp is typically called by local applications and is not inherently internet-facing. Public exposure depends entirely on whether a specific, internet-facing application improperly processes untrusted input using this function.

Integer Overflow

Gnu Glibc

before 2.3111.0 to 11.70.110.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used software component, the GNU C Library, which could allow for system crashes or unauthorized memory access when processing crafted input. This could potentially lead to denial of service or information disclosure.

Software component vulnerability could crash systems.
Affects fundamental library, broad potential impact.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending specially crafted input over the network to an application that uses a vulnerable version of the GNU C Library. If the application's code then calls the `wordexp` function with this malicious input without proper sanitization, it could lead to a crash or the disclosure of sensitive information.

No authentication or privileges required.
Triggered by crafted input to `wordexp`.
Risk of crashes or data leaks.

Live Threat

Current exploitation, exposure, and threat context

The `wordexp` function in the GNU C Library, when processing a crafted pattern, could crash or expose memory. This occurs due to incorrect calculation when converting a string to a number, potentially leading to service disruption or unauthorized information access under specific conditions.

System memory and service availability.
Untrusted input processed by `wordexp`.
Denial of service or information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the GNU C Library affects applications that use the `wordexp` function with untrusted input. Infrastructure and platform teams are likely responsible for managing the underlying C library, while application owners must identify if their specific services call this function with external data. The initial focus should be on discovering all instances of the affected library, assessing exposure to untrusted input, and confirming ownership for remediation planning.

Identify all affected systems and owners.
Verify external input processing via `wordexp`.
Plan remediation or mitigation strategies.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GNU C Library and its role in software?

The GNU C Library, or glibc, provides the core routines that programs use to communicate with the operating system. It handles fundamental tasks like memory management and string processing. Because it is a foundational component, many Linux-based operating systems and applications rely on it to function correctly.

What is the vulnerability in CVE-2021-35942?

This CVE involves an integer overflow and improper type conversion. The wordexp function, which handles pattern expansion, uses an incorrect mathematical calculation when processing input. This flaw allows a program to read memory it should not access or crash, classifying it as an issue with integer and type conversion weaknesses.

How can an attacker trigger this bug?

An attacker must supply a specifically crafted pattern to an application that passes that input directly into the wordexp function. Simply having an affected library version installed does not trigger the bug; the application must actively use this specific function to process untrusted external input to create the risk.

Do I need to worry if my application is internal?

Halo Surface Signal notes that while glibc is ubiquitous, the wordexp function is often used by local processes rather than being inherently internet-facing. Your primary concern should be applications that accept input from external users and process that data using this library, as these are more likely to reach the vulnerable code path.

How should I begin addressing this issue?

Start by identifying which systems in your environment run affected versions of glibc. Once mapped, work with your development or application teams to determine if any of your services utilize the wordexp function to process untrusted data. Prioritize reviewing the most accessible services that handle external requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.