PT-2025-23974 · Unknown+2 · Gnu C Library+2

Published 2025-06-05 · Updated 2025-10-22 · CVE-2025-5745

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.40 and later

Description The issue arises from the strncmp implementation optimized for the Power10 processor, which writes to vector registers v20 to v31 without saving the contents from the caller. This can lead to overwriting of the contents and potentially altering the control flow of the caller, or leaking the input strings to the function to other parts of the program.

Recommendations For GNU C Library versions 2.40 and later, consider saving the contents of vector registers v20 to v31 before calling the strncmp function to prevent overwriting and potential control flow alteration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2025-5745

OPENSUSE-SU-2025:15222-1

USN-7634-1

Affected Products

Gnu C Library

Linuxmint

Ubuntu

References · 19

• https://osv.dev/vulnerability/CVE-2025-5745 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7634-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5745 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5702 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-5745 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5745 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-5745 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-5745 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7634-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15222-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5745 · Vendor Advisory
• https://twitter.com/CVEnew/status/1930710317874708571 · Twitter Post
• https://suse.com/security/cve/CVE-2025-4802 · Note
• https://sourceware.org/bugzilla/show_bug.cgi?id=33060 · Note
• https://t.me/cvenotify/124915 · Telegram Post