REDHAT-BUG-2383146: Double Free
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2383146?
The severity of REDHAT-BUG-2383146 is considered high due to the potential for double free vulnerabilities that can lead to buffer manipulation.
How do I fix REDHAT-BUG-2383146?
To fix REDHAT-BUG-2383146, update the GNU C Library to a version later than 2.41.
What versions are affected by REDHAT-BUG-2383146?
REDHAT-BUG-2383146 affects GNU C Library versions from 2.4 to 2.41.
What impact does REDHAT-BUG-2383146 have on systems?
The impact of REDHAT-BUG-2383146 can include application crashes and potential arbitrary code execution due to memory corruption.
Is REDHAT-BUG-2383146 exploitable in production environments?
Yes, REDHAT-BUG-2383146 can be exploited in production environments, especially if interposed malloc functions are used.