CVE-2024-1013: Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
Other sources
An out-of-bounds stack writes on 64-bit architectures (caller has 4 bytes, callee writes 8 bytes), and seem to have gone unnoticed on little-endian architectures (although big-endian architectures must be broken).
Refer: https://github.com/lurcher/unixODBC/pull/157
— Red Hat
Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1013?
CVE-2024-1013 is classified as a high-severity vulnerability due to its potential for causing out-of-bounds stack writes.
How do I fix CVE-2024-1013?
To fix CVE-2024-1013, upgrade unixODBC to the latest version that is not vulnerable, specifically versions higher than 2.3.12-1.
What versions of unixODBC are affected by CVE-2024-1013?
CVE-2024-1013 affects unixODBC versions 2.3.6-0.1, 2.3.11-2+deb12u1, and 2.3.12-1.
Is CVE-2024-1013 more severe on big-endian architectures?
Yes, CVE-2024-1013 poses a higher risk on big-endian architectures compared to little-endian architectures due to the nature of the out-of-bounds write.
Can CVE-2024-1013 lead to remote code execution?
CVE-2024-1013 has the potential to lead to remote code execution because of the out-of-bounds stack write.