REDHAT-BUG-2524870: Medium severity GNU GNU C Library vulnerability
Non-progress DoS in SHIFTJISX0213 -> UCS-4 conversion state <br/> handling (iconvdata/shiftjisx0213.c): crafted input can cause repeated <br/> emission of a buffered code point without further input consumption, <br/> leading to persistent retry churn and denial of service in callers <br/> converting untrusted text.<br/> Requirements to exploit: An attacker must be able to supply text that an <br/> application converts from SHIFTJISX0213 to UCS-4, trigger a 2-byte <br/> sequence that expands through jisx0213toucscombining, and have the <br/> caller retry after E2BIG with the same conversion state once only enough <br/> output space remains for the first of the two emitted code points. <br/> Applications that never use this conversion path, or that abort on repeated <br/> no-progress E2BIG, are not practically exposed.<br/>
Affected Software
Event History
Frequently Asked Questions
Which applications are practically exposed to this denial of service?
Applications are exposed only if they convert attacker-controlled text from SHIFT_JISX0213 to UCS-4 and retry conversion after E2BIG while preserving the same conversion state. Applications that do not use this conversion path, or that stop after repeated E2BIG results with no progress, are not practically exposed.
What input and runtime conditions are required to trigger the issue?
The input must trigger a two-byte sequence that expands through __jisx0213_to_ucs_combining. After E2BIG, the caller must retry with only enough output space for the first of the two code points emitted by that sequence.
What can be done if a patch cannot be applied immediately?
Ensure conversion callers detect repeated E2BIG responses that consume no additional input and abort rather than retry indefinitely. Avoid converting untrusted input through the SHIFT_JISX0213-to-UCS-4 path where feasible.