CVE-2024-0684: Coreutils: heap overflow in split --line-bytes with very long lines
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the linebytessplit() function, potentially leading to an application crash and denial of service.
Other sources
Since coreutils 9.2 https://github.com/coreutils/coreutils/commit/40bf1591b introduced a heap overflow issue, which can be triggered like:
{ printf '%131070s\n' ''; printf 'x\n'; printf '%131071s\n' ''; } > in split -C 131072 ---io=131072 in
That will dump core, but as with all heap overflows is a potential security issue. I'll leave it up to you to determine whether a CVE is required.
There is already a patch upstream, but it's not flagged as a security issue, in an abundance of caution, in case this issue in more security sensitive than first envisaged. The upstream patch is: https://github.com/coreutils/coreutils/commit/c4c5ed8f4.patch
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/coreutilsto a version that resolves this vulnerability.Fixed in 9.2 - Upgrade
Upgrade
GNU coreutilsto a version that resolves this vulnerability.Patch c4c5ed8f4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0684?
CVE-2024-0684 has a severity rating of medium due to its potential to cause application crashes and denial of service.
How do I fix CVE-2024-0684?
To mitigate CVE-2024-0684, update your GNU coreutils package to version 9.3 or later.
What causes CVE-2024-0684?
CVE-2024-0684 is caused by a heap overflow vulnerability in the GNU coreutils 'split' program due to user-controlled data processing.
Which versions of coreutils are affected by CVE-2024-0684?
Versions of coreutils prior to 9.3, starting from 9.2, are affected by CVE-2024-0684.
Can CVE-2024-0684 be exploited remotely?
CVE-2024-0684 may allow for exploitation that could lead to denial of service, depending on how the 'split' program is used in a given environment.