Security readout for executives and security teams
Plain-English summary
CVE-2021-35939 is a local privilege escalation issue in RPM caused by an incomplete earlier fix. A user who already has local access and controls an ancestor directory could potentially escalate to root. Business impact is highest on shared Linux systems where untrusted or lower-privileged users have shell access.
Executive priority
Treat this as high priority for multi-user Linux environments and systems where local accounts are broadly issued. It is less urgent for single-purpose hosts with tightly controlled local access, but still should be remediated through normal security patching.
Technical view
RPM incompletely fixed CVE-2017-7500 and CVE-2017-7501 by checking only the parent directory of a file being created. The weakness is tracked as CWE-59 and can let a local unprivileged user who owns another ancestor directory potentially gain root privileges. Upstream lists the fix in RPM v4.18.
Likely exposure
Exposure is most likely on Linux systems using vulnerable RPM builds before the vendor-fixed package. The bundle identifies RPM as affected and RPM v4.18 as fixed, but does not provide a complete version range or distro backport matrix.
Exploitation context
The provided sources do not state active exploitation, and KEV status is false. Exploitation requires local unprivileged access plus a filesystem ownership condition involving an ancestor directory, so internet-facing exposure is indirect unless attackers already have local access.
Researcher notes
The source bundle is clear on impact class, affected component, CWE, and upstream fixed release, but incomplete on exact affected version ranges and downstream backports. Avoid assuming exploit availability or remote reachability without additional vendor evidence.
Mitigation direction
- Inventory systems using RPM and record vendor package versions.
- Update RPM to a vendor-fixed build; upstream fix is in RPM v4.18.
- Check Red Hat, Gentoo, and distro advisories for backported fixes.
- Restrict untrusted local shell access on affected shared systems until patched.
- Prioritize unsupported or self-built RPM installations for replacement or upgrade.
Validation and detection
- Confirm installed RPM packages include a CVE-2021-35939 fix in vendor changelogs.
- Map every RPM host to a supported distribution security advisory.
- Verify upstream builds are RPM v4.18 or later if not vendor-packaged.
- Review shared systems for local users with untrusted shell access.
- Document any exceptions where vendor fix status remains unclear.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-35939 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://rpm.org/wiki/Releases/4.18.0CVE reference
- https://github.com/rpm-software-management/rpm/pull/1919CVE reference
- https://bugzilla.redhat.com/show_bug.cgi?id=1964129CVE reference
- https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556CVE reference
- https://access.redhat.com/security/cve/CVE-2021-35939CVE reference
- GLSA-202210-22CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.