Andreas Schwab

**Nome do software vulnerável e versões afetadas** Versões da glibc anteriores à 2.31 **Descrição** O problema está relacionado a uma vulnerabilidade de gravação fora dos limites na função `backtrace` da Biblioteca C do GNU. Essa vulnerabilidade é causada por uma verificação incorreta dos limites da matriz, permitindo que um invasor acesse dados confidenciais, comprometa a integridade dos dados e, potencialmente, cause uma negação de serviço ou execute código. A maior ameaça dessa vulnerabilidade é à disponibilidade do sistema. **Recomendações** Para versões da glibc anteriores à 2.31, atualize para a versão 2.31 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso à função backtrace até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** glibc versions 2.27 and earlier **Description** The issue is caused by a buffer overflow in the mempcpy function implementation, specifically in the AVX-512-optimized version. This overflow can occur when the function writes data beyond the target buffer, leading to a potential denial of service. The vulnerable function is ` mempcpy avx512 no vzeroupper`. **Recommendations** For glibc versions 2.27 and earlier, consider disabling the ` mempcpy avx512 no vzeroupper` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GNU C Library versions prior to 2.25 **Description** The issue is related to the makecontext function in the GNU C Library, which creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This might allow attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation. The vulnerability is also associated with inadequate access control, allowing a remote attacker to cause a denial of service. **Recommendations** For GNU C Library versions prior to 2.25, update to version 2.25 or later to resolve the issue. As a temporary workaround, consider restricting the use of the makecontext function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** glibc versions prior to 2.20 **Description** The issue is related to the get contents function in the Name Service Switch (NSS) in GNU C Library, which might allow local users to cause a denial of service or gain privileges via a long line in the NSS files database. **Recommendations** For versions prior to 2.20, update to version 2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the NSS files database to minimize the risk of exploitation.