CVE-2021-28153: 
NixOS vulnerability analysis and mitigation

CVE-2021-28153 is a vulnerability discovered in GNOME GLib before version 2.66.8. The vulnerability affects the g_file_replace() function when used with G_FILE_CREATE_REPLACE_DESTINATION parameter to replace a path that is a dangling symlink. The issue was disclosed on March 11, 2021, and affects various systems and distributions using the GLib library (NVD).

The vulnerability occurs when g_file_replace() is called with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink. In this scenario, the function incorrectly creates the target of the symlink as an empty file. However, if the path is a symlink to a file that already exists, the contents of that file correctly remain unchanged. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The successful exploitation of this vulnerability could lead to addition or modification of data or potential Denial of Service (DoS). The vulnerability has particular security relevance if the symlink is attacker-controlled (NetApp Advisory).

The vulnerability has been assigned a high severity score of 7.1 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, indicating local access is required for exploitation. Public discussions of this vulnerability have been acknowledged by security vendors (NetApp Advisory).

The vulnerability has been fixed in GNOME GLib version 2.66.8. Various distributions have released security updates to address this issue, including Fedora 33 (glib2-2.66.8-1.fc33), Debian 9 stretch (2.50.3-2+deb9u3), and Red Hat Enterprise Linux. Users are advised to upgrade to the patched versions (Debian Advisory, Fedora Update).