PT-2018-1072 · Gnu+5 · Glibc+5
Halfdog
·
Publicado
2017-12-26
·
Atualizado
2025-09-29
·
CVE-2018-1000001
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
glibc versions 2.26 and earlier
Description
The issue arises from the confusion in the usage of
getcwd() by realpath() in glibc, leading to a buffer underflow. This can potentially allow for code execution. The vulnerability is caused by the operation exceeding the buffer boundaries in memory. Exploitation of this issue may enable an attacker to execute arbitrary code using a specially crafted SUID file.Recommendations
For glibc versions 2.26 and earlier, consider updating to a version later than 2.26 to resolve the issue. As a temporary workaround, restrict the use of SUID files to minimize the risk of exploitation.
Exploit
Correção
Buffer Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Glibc