PT-2020-6888 · Gnu+6 · Glibc+6

Andreas Schwab · Published 2020-01-20 · Updated 2024-06-15 · CVE-2020-1751

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glibc versions prior to 2.31

Description The issue is related to an out-of-bounds write vulnerability in the backtrace function of the GNU C Library. This vulnerability is caused by incorrect array bounds checking, allowing an attacker to access confidential data, compromise data integrity, and potentially cause a denial of service or achieve code execution. The highest threat from this vulnerability is to system availability.

Recommendations For glibc versions prior to 2.31, update to version 2.31 or later to resolve the issue. As a temporary workaround, consider restricting access to the backtrace function until a patch is available.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-2070

ALT-PU-2020-3524

ALT-PU-2021-2862

ALT-PU-2021-2880

BDU:2023-03822

CESA-2020_4444

CVE-2020-1751

OPENSUSE-SU-2024:13388-1

RHSA-2020:4444

RHSA-2020_4444

SUSE-SU-2020:0832-1

USN-4416-1

Affected Products

Alt Linux

Astra Linux

Centos

Red Hat

Suse

Ubuntu

Glibc

References · 44

• https://security.gentoo.org/glsa/202006-04 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1751 · Security Note
• https://ubuntu.com/security/notices/USN-4416-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18269 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19126 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1751 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0832-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9169 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4416-1 · Vendor Advisory
• https://usn.ubuntu.com/4416-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1751 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751 · Patch
• https://ubuntu.com/security/CVE-2018-11237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10029 · Vendor Advisory