Junglewise Threat Intelligence

CVE-2016-6264: uClibc and uClibc-ng integer signedness error in ARM memset.S

CVE-2016-6264 · Severity: high · CVSS 7.5 · Published 2017-01-27

Executive brief

A vulnerability exists in the standard C library used by many embedded devices and Linux distributions. If an application allows a user to influence the size of a memory operation, an attacker could cause the system to crash or potentially take control of the device. This impacts the reliability and security of devices using ARM processors, such as routers and IoT hardware.

Technical details

An integer signedness error exists in 'libc/string/arm/memset.S' within uClibc and uClibc-ng. The implementation uses the 'BLT' (Branch if Less Than) instruction, which performs a signed comparison on the length parameter (a3). If an attacker can provide a negative length value (e.g., 0xffff0000), the comparison fails to catch the large unsigned value, leading to an incorrect offset being added to the Program Counter (PC). This can result in a denial of service (crash) or potentially arbitrary code execution by controlling the PC register. The vulnerability is specific to the ARM architecture and was fixed in uClibc-ng version 1.0.16 by switching to unsigned comparisons.

Affected products

  • uClibc-ng project uClibc-ng before 1.0.16
  • uClibc project uClibc

Timeline

  • 2016-05-29: disclosed: Initial report of the issue in uClibc-ng mailing lists
  • 2016-07-20: patched: Fixed in uClibc-ng version 1.0.16
  • 2017-01-27: advisory: NVD publication date

References