REDHAT-BUG-2273404: High severity GNU libiconv (ISO-2022-CN-EXT plugin) vulnerability
The iconv plugin ISO-2022-CN-EXT, when converting from UCS4, might trigger a OOB write. The encoding requires to add escape sequence to indicate where it changes the character set (as described by RFC 1922) and while the bounds check is done by the SOdesignation designation, it is missing for SS2designation and SS3designation. This leads to an overflow of 1, 2, or 3 bytes with fixed values: $+I, $+J, $+K, $+L, $+M, or , $H.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds write?
An application must use the ISO-2022-CN-EXT iconv plugin to convert input from UCS4. The issue is triggered when conversion requires SS2 or SS3 character-set designation escape sequences, for which the required output bounds checks are missing.
How large is the overwrite and what data can be written?
The overflow is limited to 1, 2, or 3 bytes. The written bytes are fixed escape-sequence values: $+I, $+J, $+K, $+L, $+M, or $*H.