REDHAT-BUG-2513603: Medium severity GNU GNU C Library vulnerability
When expanding paths that begin with a tilde (~) followed by a username, the internal parsetilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they pass untrusted, attacker-controlled input to the GNU C Library wordexp function and allow tilde-prefixed paths containing a username to be expanded.
What input is required to trigger the problem?
An attacker needs to supply a path beginning with a tilde followed by an excessively long username, potentially thousands of characters. The unbounded username length can exhaust the thread stack during tilde expansion.
What is the impact of successful exploitation?
Successful exploitation can trigger a stack clash by exhausting stack space in the affected thread.