CVE-2024-2961: GNU glibc buffer overflow in iconv function

CVE-2024-2961 · Severity: high · CVSS 7.3 · Published 2024-04-17

A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems to handle basic tasks like text conversion. An attacker can exploit this flaw to crash applications or potentially take control of a server, particularly those running PHP web applications. This could lead to unauthorized access to sensitive data or a complete system compromise.

Technologies: Gnu Glibc. Vendors: Gnu.

Quick answers

Is CVE-2024-2961 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-2961 being exploited in the wild.
How severe is CVE-2024-2961?
High severity, with a CVSS score of 7.3, published 17 April 2024.
Which products and versions are affected?
Gnu Glibc 2.1.93 up to 2.40.
Is there a fix for CVE-2024-2961?
A patch was published on 2024-04-17: Fixes merged into glibc main and stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-2961 attacked?
It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2024-2961?
Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability exists in the iconv() function of glibc versions 2.39 and older. The root cause is a lack of bounds checking for SS2designation and SS3designation escape sequences when converting strings to the ISO-2022-CN-EXT character set, as specified by RFC 1922. This allows an attacker to overflow the output buffer by 1 to 3 bytes with fixed values (e.g., '$+I', '$+J'). While the overflow is small, it can be leveraged in specific environments like PHP to overwrite heap pointers, leading to arbitrary memory writes and remote code execution (RCE). The vulnerability is reachable via any application that passes attacker-controlled input to iconv(), including PHP filters. Patches are available in glibc 2.40 and various backported stable releases.

Affected products

  • GNU glibc 2.1.93 up to 2.40

Timeline

  • 2024-04-17: disclosed: Initial disclosure by glibc maintainers
  • 2024-04-17: advisory: GLIBC-SA-2024-0004 published
  • 2024-04-17: patched: Fixes merged into glibc main and stable branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.