Resource management error in GNU C Library (glibc) - CVE-2025-5702

Vulnerability identifier: #VU111872

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5702

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to alter application's behavior.

The vulnerability exists due to an error in strcmp implementation optimized for the Power10 processor. The function writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

GNU C Library (glibc)
IBM Observability with Instana
Netcool Operations Insight
Ansible Automation Platform
Red Hat build of Keycloak
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
Fedora
OpenShift API for Data Protection (OADP)
Multicluster Engine for Kubernetes
glibc (Red Hat package)
glibc (Ubuntu package)
glibc
Red Hat Ceph Storage

Install updates from vendor's website.

IBM Observability with Instana - update to 1.0.299
Netcool Operations Insight - update to 1.6.15
OpenShift API for Data Protection (OADP) - update to 1.4.5
Ansible Automation Platform - update to 2.5
Multicluster Engine for Kubernetes - update to 2.6.8
glibc (Red Hat package) - addressed in versions 2.34-168.el9_6.20, 2.39-43.el10_0
glibc (Ubuntu package) - addressed in versions 2.39-0ubuntu8.5, 2.41-6ubuntu1.1
glibc - addressed in versions 2.40-26.fc41, 2.41-7.fc42
Red Hat Ceph Storage - update to 7.1
Red Hat build of Keycloak - addressed in versions 26.0.13, 26.2.6

• https://sourceware.org/bugzilla/show_bug.cgi?id=33056

• Multiple vulnerabilities in GNU Glibc
• Fedora 42 update for glibc
• Fedora 41 update for glibc
• Red Hat Enterprise Linux 9 update for glibc
• Red Hat Enterprise Linux 10 update for glibc
• Ubuntu update for glibc
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Multiple vulnerabilities in IBM Observability with Instana (Agent)
• Multiple vulnerabilities in Red Hat build of Keycloak 26.0
• Multiple vulnerabilities in Red Hat build of Keycloak 26.2
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages