PT-2019-1344 · Gnu+1 · Glibc+1
Florian Weimer
+1
·
Published
2019-01-16
·
Updated
2020-06-13
·
CVE-2019-6488
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
glibc versions through 2.28
Description
The issue is related to the string component in the GNU C Library, specifically when running on the x32 architecture. It incorrectly attempts to use a 64-bit register for size t in assembly codes, which can lead to a segmentation fault or possibly other unspecified impacts. This is demonstrated by a crash in the
memmove avx unaligned erms function during a memcpy. The vulnerability is also associated with errors in resource release in the memmove avx unaligned erms function, which can be exploited to cause an application crash using a specially crafted file.Recommendations
For glibc versions through 2.28, consider updating to a version that addresses this issue, as the current version may lead to a segmentation fault or application crash due to incorrect register usage and resource release errors.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Glibc