{"id":"CVE-2021-45707","aliases":["GHSA-wgrg-5h56-jg27","GHSA-76w9-p8mg-j927","RUSTSEC-2021-0119"],"title":"Out-of-bounds write in nix::unistd::getgrouplist","summary":"Out-of-bounds write in nix::unistd::getgrouplist","severity":"high","vendor":"nix","product":"nix","ecosystem":"rust","affected":["nix >= 0.16.0, < 0.20.2","nix >= 0.21.0, < 0.21.2","nix >= 0.22.0, < 0.22.2"],"patched":["nix 0.20.2","nix 0.21.2","nix 0.22.2"],"published":"2022-06-17","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wgrg-5h56-jg27","references":[{"url":"https://github.com/nix-rust/nix/issues/1541"},{"url":"https://github.com/nix-rust/nix"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0119.html"}],"tags":["osv","rust"],"epss":0.0165,"epssPercentile":0.75466,"ingestedAt":"2026-07-09T18:56:37.338Z","slug":"CVE-2021-45707","body":"## Overview\n\nOn certain platforms, if a user has more than 16 groups, the\n`nix::unistd::getgrouplist` function will call the libc `getgrouplist`\nfunction with a length parameter greater than the size of the buffer it\nprovides, resulting in an out-of-bounds write and memory corruption.\n\nThe libc `getgrouplist` function takes an in/out parameter `ngroups`\nspecifying the size of the group buffer. When the buffer is too small to\nhold all of the reqested user's group memberships, some libc\nimplementations, including glibc and Solaris libc, will modify `ngroups`\nto indicate the actual number of groups for the user, in addition to\nreturning an error. The version of `nix::unistd::getgrouplist` in nix\n0.16.0 and up will resize the buffer to twice its size, but will not\nread or modify the `ngroups` variable. Thus, if the user has more than\ntwice as many groups as the initial buffer size of 8, the next call to\n`getgrouplist` will then write past the end of the buffer.\n\nThe issue would require editing /etc/groups to exploit, which is usually\nonly editable by the root user.\n\n\n## Affected packages\n\n- `nix >= 0.16.0, < 0.20.2`\n- `nix >= 0.21.0, < 0.21.2`\n- `nix >= 0.22.0, < 0.22.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nix 0.20.2`\n- `nix 0.21.2`\n- `nix 0.22.2`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}