REDHAT-BUG-2537811: Integer Overflow
An integer overflow triggered when processing inputs to the C++ new operator in libstdc+-v3/libsupc+/newopa.cc where sz + align could overflow with large sz or align, potentially resulting in an undersized allocation instead of throwing badalloc. Note that this only affects older gcc versions since 12.4 onwards (see pr113258) prefer posixmemalign over alignedalloc so on the RHEL front this should only affect RHEL9 and RHEL8 system gcc. The older libstdc++ (8.5.0) has a slightly different variant of that expression but has the same overflow problem.
Affected Software
Event History
Frequently Asked Questions
Which Red Hat Enterprise Linux systems are affected?
The issue should affect the system GCC packages on RHEL 8 and RHEL 9. The older libstdc++ 8.5.0 implementation has a different expression but the same overflow problem.
What conditions are required to trigger the issue?
An attacker or input source must cause the C++ new operator to process a sufficiently large allocation size or alignment value such that adding sz and align overflows.
What is the observable consequence of a successful overflow?
Instead of failing with bad_alloc, the overflow can cause an undersized allocation to be returned.
Are newer GCC versions affected?
The issue affects older GCC versions. GCC 12.4 and later prefer posix_memalign over aligned_alloc for this path, avoiding the described condition.