Heap-based buffer overflow in coreutils - CVE-2024-0684

Vulnerability identifier: #VU85620

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-0684

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the line_bytes_split() function. A remote attacker can pass specially crafted input to the application, trigger a heap overflow and perform a denial of service (DoS) attack.

coreutils
Gentoo Linux
Slackware Linux
Anolis OS
Fedora
coreutils
sys-apps/coreutils
coreutils-common
coreutils-single
coreutils-doc

Install updates from vendor's website.

coreutils - update to 9.3-5.fc39
sys-apps/coreutils - update to 9.4-r1
coreutils - update to 9.4-6
coreutils-common - update to 9.4-6
coreutils-single - update to 9.4-6
coreutils-doc - update to 9.4-6
coreutils - update to 9.5

• Exploit #9582 - writeup_split (March 4, 2024)

• https://seclists.org/oss-sec/2024/q1/33
• https://www.openwall.com/lists/oss-security/2024/01/18/2
• https://bugzilla.redhat.com/show_bug.cgi?id=2258948

• Denial of service in GNU coreutils
• Fedora 39 update for coreutils
• Slackware Linux update for coreutils
• Gentoo update for GNU Coreutils
• Anolis OS update for coreutils