CVE-2025-5745: Medium severity gnu c library vulnerability
The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5745?
CVE-2025-5745 is considered to have a high severity due to the potential for data corruption and unexpected behavior in applications using the affected GNU C Library.
How do I fix CVE-2025-5745?
To fix CVE-2025-5745, upgrade the GNU C Library to version 2.41 or later where the issue has been resolved.
Which versions of the GNU C Library are affected by CVE-2025-5745?
CVE-2025-5745 affects GNU C Library version 2.40 and later.
What type of applications are vulnerable to CVE-2025-5745?
Applications that depend on the strncmp implementation in the GNU C Library version 2.40 or later on Power10 processors are vulnerable to CVE-2025-5745.
Is CVE-2025-5745 specific to any hardware architecture?
Yes, CVE-2025-5745 is specifically related to the Power10 processor architecture.