SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2014-8121

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by…

MEDIUM 5.0EPSS 5.61%

Does this matter?

Lower severity and a low EPSS score (5.61%). Track it; it rarely justifies an emergency change on its own.

Description

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.

CVSS 2.0
5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS
5.61% probability · 92th percentile
CISA KEV
Not listed
Weakness
CWE-17
Affected
suse/suse linux enterprise desktop · suse/suse linux enterprise server · gnu/glibc · canonical/ubuntu linux
Source
secalert@redhat.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.