CVE-2015-20109: 
Alma Linux vulnerability analysis and mitigation

The GNU C Library (glibc) before version 2.22 contains a vulnerability in the end_pattern function (called from internal_fnmatch) that might allow context-dependent attackers to cause a denial of service (application crash). This vulnerability can be triggered by using the fnmatch library function with the **(!() pattern. This issue is tracked as CVE-2015-20109 and is distinct from CVE-2015-8984 (NVD, Ubuntu Notice).

The vulnerability exists in the end_pattern function which is called from internal_fnmatch in the GNU C Library. When processing certain pattern inputs, specifically the **(!() pattern using the fnmatch library function, the code can read past the end of a buffer, leading to a crash. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The successful exploitation of this vulnerability results in a denial of service condition through application crash. The vulnerability affects the availability of the system but does not impact confidentiality or integrity (NVD, NetApp Advisory).

The vulnerability requires local access and user interaction to exploit. An attacker needs to provide a specially crafted pattern (**(!()) to the fnmatch library function to trigger the vulnerability. The issue has been demonstrated through proof-of-concept code showing the buffer overflow condition (Sourceware Bug).

The vulnerability was fixed in GNU C Library version 2.22. Users are advised to upgrade to this version or later to address the issue. For systems that cannot be immediately upgraded, there are no documented workarounds available (NVD).