Executive brief
A vulnerability in relibc, a standard C library used by the Redox operating system, can cause applications to crash unexpectedly. By providing specially crafted, non-UTF-8 text to certain system functions, a local user or malicious program can trigger a system panic. This results in a denial-of-service condition where the affected application or service becomes unavailable.
Technical details
A denial of service vulnerability exists in relibc's `__assert_fail` function located in `src/header/assert/mod.rs`. The implementation uses `.to_str().unwrap()` on C-style strings provided as arguments (function name, file name, or condition). If these strings contain invalid UTF-8 sequences (e.g., 0xFF), the Rust `unwrap()` call triggers a panic, crashing the process. An attacker can exploit this by executing a local program that passes malformed strings to `__assert_fail`. A fix has been proposed to use `to_string_lossy()` to safely handle invalid UTF-8 data.
Affected products
- Redox OS relibc commit 61f42d6b93adc552a9e8b6f207fca907e8ca8be2 and earlier
Timeline
- 2026-02-10: patched: Merge request 986 submitted to fix the issue using to_string_lossy
- 2026-06-25: disclosed: CVE-2026-38640 published