Junglewise Threat Intelligence

CVE-2025-5278: GNU Coreutils heap buffer under-read in sort utility

CVE-2025-5278 · Severity: medium · CVSS 4.4 · Published 2025-05-27

Technologies: Gnu Coreutils. Vendors: Gnu.

Executive brief

A vulnerability was found in the GNU Coreutils 'sort' utility, a standard tool used in Linux and Unix-like systems for organizing data. By providing a specially crafted command-line argument using an older formatting style, an attacker could cause the program to crash or potentially reveal small amounts of sensitive information from the computer's memory. This issue primarily affects systems where automated scripts or users process untrusted command-line parameters.

Technical details

A heap buffer under-read exists in the begfield() function within GNU Coreutils 'sort' utility (src/sort.c). The flaw is caused by unsafe pointer arithmetic when parsing traditional key specifications (e.g., +POS1.C1). Specifically, providing a character position value of UINTMAX_MAX (18446744073709551615 on 64-bit systems) triggers an integer wraparound during the 'ptr + schar' calculation. This results in a pointer that points one byte before the start of the allocated heap buffer. When this invalid pointer is subsequently used in functions like compare_random() or strxfrm(), it triggers an out-of-bounds read. The vulnerability was introduced in version 7.2 and has been addressed in the latest source commits.

Affected products

  • GNU Coreutils 7.2 through current (pre-fix) versions

Timeline

  • 2025-05-20: disclosed: Vulnerability reported to GNU Coreutils maintainers by Med Maatallah.
  • 2025-05-27: advisory: Public disclosure and CVE assignment.

References

Related threats