CVE-2021-35937:

CVE-2021-35937 is a vulnerability, with a CVSS 3.1 base score of 6.4 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.33% probability of exploitation activity in the next 30 days, higher than 26% of all scored vulnerabilities. Microsoft released the fix on 2 September 2022 in the September 2022 Patch Tuesday. It affects 2 products in 1 product family (Mariner).

Key facts

CVE ID: CVE-2021-35937
Severity: Medium CVSS 6.4
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-59; CWE-367
EPSS: 0.33% (percentile 26%)
CISA KEV: Not listed
Released: 2 September 2022
Last updated: 2 September 2022
Patch Tuesday: September 2022 Patch Tuesday
Product families: Mariner

CVSS score and vector

Microsoft scores CVE-2021-35937 at 6.4 (temporal 6.4) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Metric	Value
Attack vector	Local
Attack complexity	High
Privileges required	High
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Affected products (2)

Mariner

Product	Security update	Type	Fixed build	Restart
CBL Mariner 2.0 x64	rpm	CBL-Mariner	4.18.0-1
CBL Mariner 2.0 ARM	rpm	CBL-Mariner	4.18.0-1

NIST NVD data

NVD status: Modified
NVD CVSS: 6.4 (MEDIUM)
NVD weakness: CWE-59; CWE-367
Published to NVD: 25 August 2022
NVD last modified: 17 June 2026

Affected configurations (CPE)

Product	Vulnerable versions
rpm	before 4.18.0
enterprise linux 6.0	all listed versions
enterprise linux 7.0	all listed versions
enterprise linux 8.0	all listed versions
enterprise linux 9.0	all listed versions
fedora 34	all listed versions

References

https://access.redhat.com/security/cve/CVE-2021-35937 (Vendor Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1964125 (Issue Tracking, Patch, Vendor Advisory)
https://rpm.org/wiki/Releases/4.18.0 (Release Notes)
https://security.gentoo.org/glsa/202210-22 (Third Party Advisory)
https://www.usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdf (Exploit, Technical Description, Third Party Advisory)
https://access.redhat.com/security/cve/CVE-2021-35937 (Vendor Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1964125 (Issue Tracking, Patch, Vendor Advisory)
https://rpm.org/wiki/Releases/4.18.0 (Release Notes)
https://security.gentoo.org/glsa/202210-22 (Third Party Advisory)
https://www.usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdf (Exploit, Technical Description, Third Party Advisory)

Revision history

Version	Date	Description
1.0	2 September 2022	Information published.