cve/2021/CVE-2021-35937.md

### [CVE-2021-35937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35937)
![](https://img.shields.io/static/v1?label=Product&message=RPM&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20Fixed%20in%20rpm%20v4.18.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-59%20-%20Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')%2C%20CWE-367%20-%20Time-of-check%20Time-of-use%20(TOCTOU)%20Race%20Condition&color=brighgreen)

### Description

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon