CVE-2021-3800: Gnome Glib Information Disclosure Flaw

CVE-2021-3800 Overview

A flaw was found in GNOME GLib before version 2.63.6. Due to random charset alias handling, pkexec can leak content from files owned by privileged users to unprivileged ones under the right conditions. This vulnerability allows local attackers to potentially access sensitive information from files they normally wouldn't have permission to read, representing a significant information disclosure risk on affected Linux systems.

Critical Impact

Local attackers can leverage charset alias behavior in GLib to leak privileged file contents to unprivileged users, potentially exposing sensitive configuration data, credentials, or other protected information.

Affected Products

• GNOME GLib (versions prior to 2.63.6)
• Debian Linux 10.0
• NetApp Active IQ Unified Manager for VMware vSphere

Discovery Timeline

• 2022-08-23 - CVE CVE-2021-3800 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3800

Vulnerability Analysis

This vulnerability stems from improper handling of charset aliases within GNOME GLib's character encoding conversion mechanisms. When GLib processes character encoding conversions, it relies on alias mappings to translate between different charset names. The flaw allows a malicious local user to manipulate these charset aliases in a way that causes pkexec (a PolicyKit utility for executing commands as another user) to inadvertently disclose file contents.

The vulnerability is classified under CWE-200 (Information Exposure) and CWE-552 (Files or Directories Accessible to External Parties), indicating it involves unauthorized access to sensitive information through improper resource handling.

Root Cause

The root cause lies in GLib's charset alias resolution mechanism. When processing character encoding conversions, GLib uses a lookup system for charset aliases that can be influenced by user-controlled input. Under specific conditions, this allows an unprivileged user to craft requests that cause privileged processes using GLib (such as pkexec) to read and potentially expose content from files that should only be accessible to privileged users.

The GNOME project addressed this issue with a commit that improves the handling of charset aliases to prevent this information leakage vector. For technical details, see the GNOME Commit Log Update.

Attack Vector

The attack requires local access to the target system. An attacker would need to:

1. Create a specially crafted environment that manipulates charset alias resolution
2. Trigger a privileged process (such as pkexec) that uses GLib for character encoding operations
3. Exploit the charset alias handling flaw to cause the privileged process to read and expose protected file contents
4. Capture the leaked information through the encoding conversion output

This attack requires user interaction to trigger the vulnerable code path, making it more difficult to exploit in automated attack scenarios. However, once the conditions are met, the attacker can gain access to sensitive file contents without requiring any privileges on those files.

The vulnerability manifests in GLib's charset alias handling code path. When a privileged process like pkexec performs character encoding conversions, the alias lookup can be manipulated to cause information disclosure. Technical details and the specific fix can be found in the GNOME GitLab commit and the Red Hat Bug Report #1938284.

Detection Methods for CVE-2021-3800

Indicators of Compromise

• Unexpected charset alias configurations in user-controlled directories
• Anomalous pkexec invocations with unusual encoding parameters
• Log entries showing encoding conversion errors or unexpected file access patterns
• Presence of symlinks or files attempting to manipulate charset alias resolution

Detection Strategies

• Monitor for suspicious pkexec executions with unusual environment variables related to character encoding
• Implement file integrity monitoring on GLib configuration and alias files
• Use audit logging to track privileged process file access patterns
• Deploy SentinelOne agents to detect anomalous behavior in PolicyKit-related processes

Monitoring Recommendations

• Enable auditd rules to monitor pkexec executions and associated file access
• Configure syslog to capture GLib-related error messages and warnings
• Implement endpoint detection and response (EDR) solutions to identify exploitation attempts
• Review system logs for patterns indicating charset alias manipulation attempts

How to Mitigate CVE-2021-3800

Immediate Actions Required

• Update GNOME GLib to version 2.63.6 or later on all affected systems
• Apply vendor-specific patches from Debian, Red Hat, or NetApp as applicable
• Review system configurations for any suspicious charset alias modifications
• Audit privileged process usage, particularly pkexec invocations

Patch Information

GNOME has released a fix in GLib version 2.63.6. The specific commit addressing this vulnerability is available in the GNOME GitLab repository.

Distribution-specific patches are available:

• Red Hat/CentOS: See the Red Hat CVE-2021-3800 Advisory
• Debian: Refer to the Debian LTS Announcement
• NetApp: Consult the NetApp Security Advisory NTAP-20221028-0004

Workarounds

• Restrict local access to systems running vulnerable GLib versions
• Implement strict user privilege separation to minimize exposure
• Consider disabling or restricting pkexec usage where not required
• Apply security policies that limit environment variable manipulation for privileged processes

# Verify GLib version on affected systems
pkg-config --modversion glib-2.0

# Check for available updates (Debian/Ubuntu)
apt-get update && apt-cache policy libglib2.0-0

# Check for available updates (RHEL/CentOS)
yum check-update glib2