CVE-2018-6551: Integer Overflow
The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZEMAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU C Library (glibc / libc6)to a version that resolves this vulnerability.Fixed in 2.26
Event History
Frequently Asked Questions
What is the vulnerability CVE-2018-6551?
The vulnerability CVE-2018-6551 is a memory allocation issue in the GNU C Library (glibc) versions 2.24 to 2.26 on powerpc and version 2.26 on i386, which can lead to a smaller heap region being returned than requested.
How severe is CVE-2018-6551?
CVE-2018-6551 has a severity rating of 9.8, which is considered critical.
What software is affected by CVE-2018-6551?
The GNU C Library (glibc) versions 2.24 to 2.26 on powerpc and version 2.26 on i386 are affected by CVE-2018-6551.
How can I fix CVE-2018-6551?
Apply the appropriate patch or update provided by the software vendor to fix CVE-2018-6551.
Is there any additional information about CVE-2018-6551?
For additional information about CVE-2018-6551, you can refer to the references provided: [NetApp Security Advisory](https://security.netapp.com/advisory/ntap-20190404-0003/), [Bugzilla](https://sourceware.org/bugzilla/show_bug.cgi?id=22774), and [Git Repository](https://sourceware.org/git/?p=glibc.git;a=commit;h=8e448310d74b283c5cd02b9ed7fb997b47bf9b22).