PT-2025-3866 · Gnu+11 · Gnu C Library+11
Published
2025-01-10
·
Updated
2026-02-04
·
CVE-2025-0395
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
GNU C Library versions 2.13 through 2.40
Description
The issue is related to the
assert() function in the GNU C Library, which fails to allocate sufficient space for the assertion failure message string and size information. This may lead to a buffer overflow if the message string size aligns with the page size. The buffer overflow is mmap-based and limited to at most an off-by-four bytes, with the attacker not having control over the four bytes that overflow the buffer.Recommendations
For GNU C Library versions 2.13 through 2.40, consider disabling the
assert() function as a temporary workaround until a patch is available. Restrict access to the assert() function to minimize the risk of exploitation. Avoid using the assert() function in critical code paths until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Gnu C Library
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu