REDHAT-BUG-2525256: Buffer Overflow
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate application-supplied values for the `ccs` parameter before passing them to the GNU C Library `fopen` function; do not pass attacker-controlled `ccs` values through without validation, especially empty strings.
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed only if they use fopen with the ,ccs= mode-string extension and allow an attacker to control the mode string or the ccs value without validation. This usage pattern is not seen in applications in common GNU/Linux distributions.
What input is needed to trigger the issue?
The attacker-controlled mode argument must use the ,ccs= extension with an effectively empty string supplied as its value. The affected behavior applies to GNU C Library version 2.45 or earlier.
What can be done if an update is not immediately available?
Do not pass user-supplied ccs values directly into fopen mode strings. Validate and constrain any ccs value before constructing or passing the mode argument, and reject effectively empty values.