Executive brief
A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems to handle basic tasks like text conversion. An attacker can exploit this flaw to crash applications or potentially take control of a server, particularly those running PHP web applications. This could lead to unauthorized access to sensitive data or a complete system compromise.
Technical details
An out-of-bounds write vulnerability exists in the iconv() function of glibc versions 2.39 and older. The root cause is a lack of bounds checking for SS2designation and SS3designation escape sequences when converting strings to the ISO-2022-CN-EXT character set, as specified by RFC 1922. This allows an attacker to overflow the output buffer by 1 to 3 bytes with fixed values (e.g., '$+I', '$+J'). While the overflow is small, it can be leveraged in specific environments like PHP to overwrite heap pointers, leading to arbitrary memory writes and remote code execution (RCE). The vulnerability is reachable via any application that passes attacker-controlled input to iconv(), including PHP filters. Patches are available in glibc 2.40 and various backported stable releases.
Affected products
- GNU glibc 2.1.93 up to 2.40
Timeline
- 2024-04-17: disclosed: Initial disclosure by glibc maintainers
- 2024-04-17: advisory: GLIBC-SA-2024-0004 published
- 2024-04-17: patched: Fixes merged into glibc main and stable branches
References
- http://www.openwall.com/lists/oss-security/2024/04/17/9
- http://www.openwall.com/lists/oss-security/2024/04/18/4
- http://www.openwall.com/lists/oss-security/2024/04/24/2
- http://www.openwall.com/lists/oss-security/2024/05/27/1
- http://www.openwall.com/lists/oss-security/2024/05/27/2
- http://www.openwall.com/lists/oss-security/2024/05/27/3
- http://www.openwall.com/lists/oss-security/2024/05/27/4