CVE-2021-20197

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "redhat:enterprise_linux",
            "extracted_events": [
                {
                    "last_affected": "8.0"
                }
            ]
        }
    ]
}

References

CVE-2021-20197

Affected packages