CVE-2025-0395: GNU glibc buffer overflow in assert function failure handling

CVE-2025-0395 · Severity: medium · CVSS 6.2 · Published 2025-01-22

The GNU C Library (glibc), a core component of almost all Linux-based systems, contains a flaw in how it handles program errors. When a program crashes due to a failed 'assertion' (a self-check used by developers), the library may fail to allocate enough memory to store the error message. In specific scenarios involving specialized system programs, a local attacker could potentially use this to cause a further system crash or interfere with operations.

Technologies: Gnu Glibc. Vendors: Gnu.

Quick answers

Is CVE-2025-0395 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-0395 being exploited in the wild.
How severe is CVE-2025-0395?
Medium severity, with a CVSS score of 6.2, published 22 January 2025.
Which products and versions are affected?
Gnu Glibc 2.13 to 2.40.
Is there a fix for CVE-2025-0395?
A patch was published on 2025-01-22: Fixes committed to glibc master and stable branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-0395 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-0395?
Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer overflow exists in glibc's __assert_fail_base() function due to an incorrect calculation of the required buffer size. When allocating memory via mmap() for the abort_msg_s struct, the code accounts for the message string and its null terminator but fails to include the space required for the 'size' integer field within the struct. If the message length (plus terminator) is exactly a multiple of the system page size, the subsequent strcpy() will write the final bytes of the message beyond the mapped memory boundary. Exploitation is primarily limited to local vectors where an attacker can control the program name or environment of a setuid binary that triggers an assertion failure. Patches have been released for glibc versions 2.34 through 2.41.

Affected products

  • GNU glibc 2.13 to 2.40

Timeline

  • 2025-01-10: disclosed: Qualys reported the vulnerability to glibc security team.
  • 2025-01-22: patched: Fixes committed to glibc master and stable branches.
  • 2025-01-22: advisory: GLIBC-SA-2025-0001 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.