CVE-2020-29573
glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.
El archivo sysdeps/i386/ldbl2mpn.c en la GNU C Library (también se conoce como glibc o libc6) versiones anteriores a 2.23 en objetivos x86 presenta un desbordamiento de búfer en la región stack de la memoria si la entrada a cualquiera de la familia funciones printf es un doble longitud de 80 bits con un patrón de bits no canónico, como se ve al pasar un valor \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 a sprintf. NOTA: la cuestión no afecta a la glibc por defecto en 2016 o más tarde (es decir, 2,23 o más tarde), debido a los compromisos contraídos en 2015 para alinear las funciones matemáticas del C99 mediante el uso de los elementos incorporados del GCC. En otras palabras, la referencia a 2.23 es intencional a pesar de la mención de "Fijado para glibc 2.33" en la referencia 26649
A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-12-05 CVE Reserved
- 2020-12-05 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-121: Stack-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://security.netapp.com/advisory/ntap-20210122-0004 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://sourceware.org/bugzilla/show_bug.cgi?id=26649 | 2023-04-26 | |
https://sourceware.org/pipermail/libc-alpha/2020-September/117779.html | 2023-04-26 |
URL | Date | SRC |
---|---|---|
https://security.gentoo.org/glsa/202101-20 | 2023-04-26 | |
https://access.redhat.com/security/cve/CVE-2020-29573 | 2021-08-31 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1905213 | 2021-08-31 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Gnu Search vendor "Gnu" | Glibc Search vendor "Gnu" for product "Glibc" | < 2.23 Search vendor "Gnu" for product "Glibc" and version " < 2.23" | x86 |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0" | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Cloud Backup Search vendor "Netapp" for product "Cloud Backup" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Solidfire Baseboard Management Controller Search vendor "Netapp" for product "Solidfire Baseboard Management Controller" | - | - |
Affected
|