Executive brief
relibc is a C standard library implementation used by the Redox operating system. A flaw in the execl() function allows a local attacker to crash processes by passing an excessive number of arguments, resulting in denial of service.
Technical details
An index out of bounds vulnerability exists in the with_argv function (src/header/unistd/mod.rs) when handling execl() calls with many arguments. The vulnerable code writes to out[argc] without verifying that argc fits within the allocated buffer bounds. The attack is local: an attacker executes a program that calls execl() with over 100 arguments, triggering a buffer overflow that causes an invalid opcode fault and kernel panic. A fix is available in merge request 989 at the relibc repository.
Affected products
- Redox OS relibc commit 61f42d and earlier
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix available in merge request 989