{"id":"GHSA-wgrg-5h56-jg27","summary":"Out-of-bounds write in nix::unistd::getgrouplist","details":"On certain platforms, if a user has more than 16 groups, the\n`nix::unistd::getgrouplist` function will call the libc `getgrouplist`\nfunction with a length parameter greater than the size of the buffer it\nprovides, resulting in an out-of-bounds write and memory corruption.\n\nThe libc `getgrouplist` function takes an in/out parameter `ngroups`\nspecifying the size of the group buffer. When the buffer is too small to\nhold all of the reqested user's group memberships, some libc\nimplementations, including glibc and Solaris libc, will modify `ngroups`\nto indicate the actual number of groups for the user, in addition to\nreturning an error. The version of `nix::unistd::getgrouplist` in nix\n0.16.0 and up will resize the buffer to twice its size, but will not\nread or modify the `ngroups` variable. Thus, if the user has more than\ntwice as many groups as the initial buffer size of 8, the next call to\n`getgrouplist` will then write past the end of the buffer.\n\nThe issue would require editing /etc/groups to exploit, which is usually\nonly editable by the root user.\n","aliases":["CVE-2021-45707","GHSA-76w9-p8mg-j927","RUSTSEC-2021-0119"],"modified":"2026-09-10T03:49:44.230755296Z","published":"2022-06-17T00:13:59Z","database_specific":{"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-06-17T00:13:59Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/nix-rust/nix/issues/1541"},{"type":"PACKAGE","url":"https://github.com/nix-rust/nix"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0119.html"}],"affected":[{"package":{"name":"nix","ecosystem":"crates.io","purl":"pkg:cargo/nix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.16.0"},{"fixed":"0.20.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-wgrg-5h56-jg27/GHSA-wgrg-5h56-jg27.json"}},{"package":{"name":"nix","ecosystem":"crates.io","purl":"pkg:cargo/nix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.21.0"},{"fixed":"0.21.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-wgrg-5h56-jg27/GHSA-wgrg-5h56-jg27.json"}},{"package":{"name":"nix","ecosystem":"crates.io","purl":"pkg:cargo/nix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.22.0"},{"fixed":"0.22.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-wgrg-5h56-jg27/GHSA-wgrg-5h56-jg27.json"}}],"schema_version":"1.9.0"}