Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ef2903a0-df4a-4d58-8165-78dbb43622de

Domainunvalidated

Buffer Overflow

ef2903a0-df4a-4d58-8165-78dbb43622de

Buffer Overflow

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

10 linked nodes

PERTAIN_TOReport

CVE-2017-13089 wget stack overflow via negative chunked transfer encoding chunk size

PERTAIN_TOReport

CVE-2023-4911 Looney Tunables Stack Buffer Overflow in glibc __tunables_init

PERTAIN_TOReport

CVE-2020-10713 BootHole: Integer Overflow → Heap Buffer Overflow in GRUB2 Script Lexer (grub-core/script/yylex.l)

PERTAIN_TOProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PERTAIN_TOSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

PERTAIN_TOProblem

stack buffer overflow when processing HTTP chunked transfer encoding responses — when wget encounters 3xx redirects with chunked bodies. Outcome: This affects the 'skip redirect body' code path.

PERTAIN_TOProblem

When a GRUB script token exceeds YYLMAX size — in GRUB2 2.04 (and earlier). Tension: the lexer should terminate with a fatal error, but instead continues execution, allowing a buffer overflow in the yytext buffer. Outcome: This can lead to code execution and Secure Boot bypass.

PERTAIN_TORootCause

processed twice, first as name=name=val and next as name=val — when a malformed tunable value of the form 'name=name=val' is parsed in the AT_SECURE (setuid) path. Tension: tunestr being name=name=val:name=val, thus overflowing tunestr.

PERTAIN_TORootCause

Outcome: grub_realloc() to allocate a buffer far too small for the actual data.

PERTAIN_TOSolution

change `unsigned len` to `grub_size_t len` and `unsigned hint` parameter to `grub_size_t hint`. Tension: The bounds check should use: `if (parser->lexerstate->used + len < parser->lexerstate->used || parser->lexerstate->used + len >= parser->lexerstate->size)`. Outcome: The struct fields `used` and `size` in grub_lexer_param should be widened to `grub_size_t`.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata