PT-2023-1588 · Gnu · Glibc

Klaus Dittrich

+1

·

Published

2023-02-03

·

Updated

2025-03-26

·

CVE-2023-25139

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions glibc version 2.37
Description The issue is caused by a buffer overflow in the sprintf function of the GNU C Library (glibc). This overflow occurs when the function attempts to write a padded, thousands-separated string representation of a number into a buffer that is allocated the exact size required to represent that number as a string. For example, the number 1,234,567 with padding to 13 characters can cause an overflow of two bytes. This may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.
Recommendations For glibc version 2.37, consider disabling the sprintf function until a patch is available to prevent potential buffer overflows. Restrict the use of the sprintf function with padded, thousands-separated string representations of numbers to minimize the risk of exploitation. Avoid using the sprintf function with buffers allocated to the exact size required to represent a number as a string until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2023-01081
CVE-2023-25139
OPENSUSE-SU-2024:13123-1

Affected Products

Glibc