CVE-2025-5702: Medium severity GNU C Library vulnerability
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5702?
CVE-2025-5702 is classified as a critical vulnerability due to the potential for overwriting non-volatile registers.
How do I fix CVE-2025-5702?
To address CVE-2025-5702, upgrade to a patched version of the GNU C Library version 2.39 or later that is specifically fixed for this vulnerability.
What systems are affected by CVE-2025-5702?
CVE-2025-5702 affects systems using the GNU C Library version 2.39 or later on Power10 processor architectures.
What are the potential outcomes of exploiting CVE-2025-5702?
Exploiting CVE-2025-5702 could lead to unpredictable behavior in applications due to the unintended modification of non-volatile registers.
Who is responsible for addressing CVE-2025-5702?
Maintainers of the GNU C Library are responsible for addressing CVE-2025-5702 by providing updates and patches.