REDHAT-BUG-2523274: Medium severity GNU glibc vulnerability
Summary: Non-progress DoS in SHIFTJISX0213 -> UCS-4 conversion state <br/> handling (iconvdata/shiftjisx0213.c): crafted input can cause repeated <br/> emission of a buffered code point without further input consumption, <br/> leading to persistent retry churn and denial of service in callers <br/> converting untrusted text.<br/> Requirements to exploit: An attacker must be able to supply text that an <br/> application converts from SHIFTJISX0213 to UCS-4, trigger a 2-byte <br/> sequence that expands through jisx0213toucscombining, and have the <br/> caller retry after E2BIG with the same conversion state once only enough <br/> output space remains for the first of the two emitted code points. <br/> Applications that never use this conversion path, or that abort on repeated <br/> no-progress E2BIG, are not practically exposed.<br/> Component affected: glibc-2.42-11.1.hum1; iconvdata/shiftjisx0213.c, <br/> fromshiftjisx0213 (BODY macro) in the SHIFTJISX0213 -> UCS-4 <br/> conversion path.<br/>
Affected Software
Event History
Frequently Asked Questions
Which applications are practically exposed to this denial of service?
Applications are practically exposed only if they convert attacker-controlled text from SHIFT_JISX0213 to UCS-4 and retry conversion after E2BIG while preserving the same conversion state. Applications that do not use this conversion path, or that stop after repeated E2BIG errors with no progress, are not practically exposed.
What input and output-buffer conditions are required to trigger the issue?
The supplied text must trigger a two-byte sequence that expands through __jisx0213_to_ucs_combining. After E2BIG, the caller must retry with enough output space for only the first of the two output code points, causing the buffered code point to be emitted repeatedly without consuming further input.
What can be done if updating is not immediately possible?
Avoid converting untrusted SHIFT_JISX0213 input to UCS-4 where possible. Callers should detect repeated E2BIG results without input progress and abort rather than retry indefinitely.