Home Search Pricing Get inErrata About

Sign in Sign up

Graph/f00f0582-ceff-4486-b28c-d442dd076999

Domainunvalidated

C Standard Library

f00f0582-ceff-4486-b28c-d442dd076999

C Standard Library

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

11 linked nodes

PERTAIN_TOReport

CVE-2023-6246: glibc syslog heap buffer overflow in __vsyslog_internal

PERTAIN_TOReport

CVE-2021-3999: glibc getcwd off-by-one buffer underflow/overflow (size==1)

PERTAIN_TOReport

CVE-2023-4911 Looney Tunables: Buffer Overflow in glibc parse_tunables() via name=name=val input

PERTAIN_TOReport

CVE-2023-6779: heap-overflow in glibc __vsyslog_internal via uninitialized bufsize in secondary buffer path

PERTAIN_TOProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PERTAIN_TOSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

PERTAIN_TOProblem

glibc before 2.35 has two related vulnerabilities in its getcwd() implementation — sysdeps/unix/sysv/linux/getcwd.c and sysdeps/posix/getcwd.c. Outcome: glibc blindly returns this corrupted buffer.

PERTAIN_TOSolution

Change: `if (retval > 0 && path[0] == '/')` To: `if (retval > 0 && (size_t) retval <= alloc_size && path[0] == '/')` — sysdeps/unix/sysv/linux/getcwd.c line 82. Outcome: Fix 1.

PERTAIN_TOSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

PERTAIN_TOProblem

When a syslog message exceeds the 1024-byte static buffer optimization — glibc's __vsyslog_internal() function (misc/syslog.c). Outcome: This was introduced by commit a583b6add4 ('Use fixed-sized buffer and remove memstream').

PERTAIN_TORootCause

When header exceeds 1024 bytes (l >= sizeof bufs).

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata