Junglewise Threat Intelligence

CVE-2016-2090: freedesktop libbsd heap buffer overflow in fgetwln

CVE-2016-2090 · Severity: critical · CVSS 9.8 · Published 2017-01-13

Executive brief

libbsd is a software library that provides common BSD system functions to other operating systems like Linux. A flaw in how it handles memory when reading wide-character strings could allow an attacker to crash applications using this library or potentially execute unauthorized code. This impact depends on how a specific application utilizes the affected library function.

Technical details

An off-by-one vulnerability exists in the fgetwln() function within libbsd versions prior to 0.8.2. The root cause is an incorrect boundary check in a while loop: the code checks if 'wused > fb->len' before reallocating memory, but fails to account for the case where 'wused == fb->len', leading to an out-of-bounds write of 4 bytes (a wide character) to the heap. While the attack vector is listed as network-reachable, exploitation requires an application to use fgetwln() to process attacker-controlled input. Successful exploitation could result in a heap buffer overflow, potentially leading to arbitrary code execution or a denial-of-service condition. The issue was fixed in libbsd version 0.8.2.

Affected products

  • freedesktop libbsd before 0.8.2

Timeline

  • 2016-01-27: disclosed: Vulnerability reported by Hanno Böck
  • 2016-01-27: patched: Fixed in libbsd version 0.8.2
  • 2017-01-13: advisory: NVD published CVE-2016-2090

References