Input validation error in GNU C Library (glibc) - CVE-2019-7309
Published: February 5, 2019 / Updated: March 1, 2019
Vulnerability identifier: #VU17377
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7309
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) when the RDX most significant bit is mishandled. A local attacker can supply specially crafted input and cause the application to crash.
Affected software
GNU C Library (glibc)
Gentoo Linux
Netcool Operations Insight
IBM Cloud Transformation Advisor
Robotic Process Automation for Cloud Pak
Gentoo Linux
Netcool Operations Insight
IBM Cloud Transformation Advisor
Robotic Process Automation for Cloud Pak
How to mitigate CVE-2019-7309
Update to version 2.30, when available.
GNU C Library (glibc) - update to 2.30
Netcool Operations Insight - update to 1.6.8
IBM Cloud Transformation Advisor - update to 3.10.0
Robotic Process Automation for Cloud Pak - update to 21.0.6
Netcool Operations Insight - update to 1.6.8
IBM Cloud Transformation Advisor - update to 3.10.0
Robotic Process Automation for Cloud Pak - update to 21.0.6