PT-2024-1284 · Gnu+1 · Gnu Coreutils+1

Valentin Metz · Published 2024-01-18 · Updated 2025-10-25 · CVE-2024-0684

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Coreutils versions prior to 9.4-3.1

Description A heap overflow issue exists in the split program within GNU Coreutils. The flaw is located in the line bytes split() function (src/split.c) and occurs when processing long lines, specifically when using the --line-bytes or -C option. This can lead to an application crash and a denial of service. The issue was identified during analysis of failures when using the split utility to process data transmitted via QR codes. The overflow involves user-controlled data of several hundred bytes in length.

Recommendations Update GNU Coreutils to version 9.4-3.1 or later.

Exploit

Fix

DoS

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

AZL-34629

BDU:2024-00722

CVE-2024-0684

OPENSUSE-SU-2024:13618-1

ROSA-SA-2025-2611

Affected Products

Gnu Coreutils

Red Os

References · 41

• 🔥 https://github.com/Valentin-Metz/writeup_split · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2024-0684 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-0684 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00722 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-0684 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2KAURFJIEYY2BWCPN4AZDYCVMFD5J4GB · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13618-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2258948 · Patch
• https://openwall.com/lists/oss-security/2024/01/18/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0684 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-0684 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0684 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-0684 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-0684 · Vendor Advisory