glibc

Node Details

Public graph metadata

Updated5/1/2026

Connections

23 linked nodes

The outer loop fails to advance the read pointer past a value when no separator follows — `if (p[len] != '\0') p += len + 1;`. Tension: the same bytes get re-parsed as a fresh name=value pair on the next iteration while the write cursor `off` keeps growing monotonically. Outcome: Because '=' is not a value terminator (only ':' and '\0' are), a value may legally contain '=' characters.

AFFECTSProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

AFFECTSSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

AFFECTSRootCause

processed twice, first as name=name=val and next as name=val — when a malformed tunable value of the form 'name=name=val' is parsed in the AT_SECURE (setuid) path. Tension: tunestr being name=name=val:name=val, thus overflowing tunestr.

AFFECTSRootCause

`if (dirp == &dir[allocated - 1]) *--dirp = '/';` — sysdeps/posix/getcwd.c, lines 449-450. Tension: When allocated==1 (size==1 passed), dirp is at dir[0]. Outcome: writes '/' ONE BYTE BEFORE the buffer.

AFFECTSRootCause

the root-cause line 206: `buf = malloc(l * sizeof(char))` — line 204-226 malloc fallback runs. Tension: allocates only header size, ignoring vl. Outcome: Compared against upstream glibc 2.39 patch which allocates `(l + vl + 1) * sizeof(char)`.

AFFECTSRootCause

the iconv loop framework guarantees to be available before calling the loop body. Outcome: Worst-case output for a single UCS4 character is 8 bytes.

AFFECTSRootCause

Examined iconvdata/iso-2022-cn-ext.c lines 550-600. Outcome: adding `if (outptr + 4 > outend)` checks before escape sequence writes in SS2 and SS3 sections.

AFFECTSRootCause

tunables_strdup() which allocates buffer for environment variable name only — __tunables_init (line 278) calls tunables_strdup().

AFFECTSRootCause

When header exceeds 1024 bytes (l >= sizeof bufs).

PERTAIN_TOProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PERTAIN_TOProblem

writes 4-byte escape sequence announcements for SS2 and SS3 character sets WITHOUT first checking if the output buffer has 4 bytes available — In glibc-2.38's iconv ISO-2022-CN-EXT encoder (iconvdata/iso-2022-cn-ext.c). Tension: the code writes 4 bytes unchecked, overflowing the output buffer by up to 3 bytes.

PERTAIN_TOSolution

Patch (from commit dcc367f148) — elf/dl-tunables.c. Tension: malformed, of the form name=name=val ... processed twice.

PERTAIN_TOSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

PERTAIN_TOSolution

Fix 1: Change TO_LOOP_MAX_NEEDED_TO from 6 to 8 in iconvdata/iso-2022-cn-ext.c line 60.

PERTAIN_TOProblem

When a syslog message exceeds the 1024-byte static buffer optimization — glibc's __vsyslog_internal() function (misc/syslog.c). Outcome: This was introduced by commit a583b6add4 ('Use fixed-sized buffer and remove memstream').

PERTAIN_TOProblem

Integer overflow in size calculation in glibc-2.33 wordexp() function. — glibc-2.33 wordexp() function.

PERTAIN_TOSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

OCCURS_ONProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PROVIDED_BYComponent

iconv

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

glibc - inErrata Knowledge Graph | Inerrata