CVE-2021-3997

NameCVE-2021-3997
DescriptionA flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1003467

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
systemd (PTS)jessie, jessie (lts)215-17+deb8u15vulnerable
stretch (security)232-25+deb9u14vulnerable
stretch (lts), stretch232-25+deb9u17vulnerable
buster, buster (lts)241-7~deb10u11vulnerable
buster (security)241-7~deb10u10vulnerable
bullseye247.3-7+deb11u5fixed
bullseye (security)247.3-7+deb11u6fixed
bookworm252.31-1~deb12u1fixed
sid, trixie257~rc2-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
systemdsourcebullseye247.3-7
systemdsource(unstable)250.2-11003467

Notes

[buster] - systemd <ignored> (Minor issue; not exploitable before upstream commit e535840)
[stretch] - systemd <ignored> (Minor issue; utility segfault; not exploitable before upstream commit e535840, PoC doesn't segfault on stretch)
https://bugzilla.redhat.com/show_bug.cgi?id=2024639
https://github.com/systemd/systemd/pull/22070
https://www.openwall.com/lists/oss-security/2022/01/10/2
Exploitable after (but present before): https://github.com/systemd/systemd/commit/e5358401b5df8d395e99815b7a69b8424887472c (v242-rc1)
PoC still crashes on jessie/215-17+deb8u14
Prerequisite/Preparation: https://github.com/systemd/systemd/commit/3bac86abfa1b1720180840ffb9d06b3d54841c11
Prerequisite/Preparation: https://github.com/systemd/systemd/commit/84ced330020c0bae57bd4628f1f44eec91304e69
Fixed by: https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1
[jessie] - systemd <ignored> (Minor issue; not exploitable before upstream commit e535840)

Search for package or bug name: Reporting problems