Junglewise Threat Intelligence

CVE-2025-0395: GNU glibc buffer overflow in assert function failure handling

CVE-2025-0395 · Severity: medium · CVSS 6.2 · Published 2025-01-22

Technologies: Gnu Glibc. Vendors: Gnu.

Executive brief

The GNU C Library (glibc), a core component of almost all Linux-based systems, contains a flaw in how it handles program errors. When a program crashes due to a failed 'assertion' (a self-check used by developers), the library may fail to allocate enough memory to store the error message. In specific scenarios involving specialized system programs, a local attacker could potentially use this to cause a further system crash or interfere with operations.

Technical details

A buffer overflow exists in glibc's __assert_fail_base() function due to an incorrect calculation of the required buffer size. When allocating memory via mmap() for the abort_msg_s struct, the code accounts for the message string and its null terminator but fails to include the space required for the 'size' integer field within the struct. If the message length (plus terminator) is exactly a multiple of the system page size, the subsequent strcpy() will write the final bytes of the message beyond the mapped memory boundary. Exploitation is primarily limited to local vectors where an attacker can control the program name or environment of a setuid binary that triggers an assertion failure. Patches have been released for glibc versions 2.34 through 2.41.

Affected products

  • GNU glibc 2.13 to 2.40

Timeline

  • 2025-01-10: disclosed: Qualys reported the vulnerability to glibc security team.
  • 2025-01-22: patched: Fixes committed to glibc master and stable branches.
  • 2025-01-22: advisory: GLIBC-SA-2025-0001 published.

References

Related threats