PT-2014-2127 · Gnu · Eglibc+1

Published 2014-10-27 · Updated 2023-02-13 · CVE-2011-2702

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Glibc versions prior to 2.13 eglibc versions prior to 2.13

Description The issue is related to an integer signedness error when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization. This error allows context-dependent attackers to execute arbitrary code via a negative length parameter to certain functions, which triggers an out-of-bounds read. The affected functions include memcpy-ssse3-rep.S, memcpy-ssse3.S, and memset-sse2.S in sysdeps/i386/i686/multiarch/.

Recommendations For Glibc versions prior to 2.13, update to version 2.13 or later. For eglibc versions prior to 2.13, update to version 2.13 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-2702

Affected Products

Glibc

Eglibc

References · 10

• 🔥 http://xorl.wordpress.com/2011/08/06/cve-2011-2702-eglibc-and-glibc-signedness-issue · Exploit
• 🔥 https://exploit-db.com/exploits/20167 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-2702 · Security Note
• https://bugzilla.novell.com/show_bug.cgi?id=706915 · Note
• http://seclists.org/oss-sec/2011/q3/153 · Note
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=a0ac24d98ace90d1ccba6a2f3e7d55600f2fdb6e · Note
• http://seclists.org/oss-sec/2011/q3/123 · Note
• http://nodefense.org/eglibc.txt · Note
• http://osvdb.org/80718 · Note
• http://eglibc.org/cgi-bin/viewvc.cgi/trunk/libc/ChangeLog?view=markup&pathrev=10032 · Note