Executive brief
A security vulnerability exists in glib-networking, a library used by many Linux applications to handle secure network connections. When using the OpenSSL backend to process security certificates, the software may fail to properly terminate data strings, leading to memory errors. This could allow an attacker to cause an application to crash or potentially expose small amounts of sensitive memory during secure connection attempts.
Technical details
An out-of-bounds read vulnerability exists in glib-networking's OpenSSL backend within the g_tls_certificate_openssl_get_property() function. The code incorrectly validates the return value of BIO_write() when attempting to append a null terminator to a PEM-encoded certificate; specifically, it uses logical negation on the return value, which fails to catch error codes like -1 or -2. If BIO_write() fails (e.g., due to memory pressure), the code proceeds to call g_value_set_string(), which triggers a strlen() on an unterminated buffer. This results in an out-of-bounds read that can lead to a process crash (DoS) or the leakage of adjacent memory contents. The vulnerability is fixed in version 2.80.2.
Affected products
- GNOME glib-networking 2.60 to 2.80.1
Timeline
- 2025-06-29: disclosed: Reported via YesWeHack
- 2025-08-05: patched: Fix merged in version 2.80.2
- 2025-09-25: advisory: CVE published