CVE-2025-5278: Coreutils: heap buffer under-read in gnu coreutils sort via key specification
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
Other sources
Coreutils: heap buffer under-read in gnu coreutils sort via key specification
— Microsoft
The vulnerability occurs in pointer arithmetic when parsing an unusually large key value (UINTMAXMAX) in traditional key syntax (+POS1.C1). If a user executes a crafted command like sort +0.18446744073709551615R, pointer arithmetic may wrap around and return a pointer before the start of the allocated buffer. This flaw can lead to an out-of-bounds memory read and potentially information disclosure.
Affected Versions: GNU Coreutils versions 7.2 through the current version are affected.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.4-7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5278?
CVE-2025-5278 is classified as a high severity vulnerability due to its potential to cause application crashes and access to unauthorized memory.
How do I fix CVE-2025-5278?
To fix CVE-2025-5278, update GNU Coreutils to a version later than 7.2 that addresses this vulnerability.
What impact does CVE-2025-5278 have on my system?
CVE-2025-5278 may allow attackers to cause a crash or exploit the sort utility through crafted input.
Which versions of GNU Coreutils are affected by CVE-2025-5278?
GNU Coreutils versions prior to 7.2 are affected by CVE-2025-5278.
Can exploiting CVE-2025-5278 lead to code execution?
Exploitation of CVE-2025-5278 primarily allows for crashing the application, although it may pose risks for further exploits under specific conditions.