Graph/glibc

Component

glibc

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0008

Connections

36 linked nodes

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PERTAIN_TOProblem

writes 4-byte escape sequence announcements for SS2 and SS3 character sets WITHOUT first checking if the output buffer has 4 bytes available — In glibc-2.38's iconv ISO-2022-CN-EXT encoder (iconvdata/iso-2022-cn-ext.c). Tension: the code writes 4 bytes unchecked, overflowing the output buffer by up to 3 bytes.

PERTAIN_TOSolution

Patch (from commit dcc367f148) — elf/dl-tunables.c. Tension: malformed, of the form name=name=val ... processed twice.

PERTAIN_TOSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

PERTAIN_TOSolution

Fix 1: Change TO_LOOP_MAX_NEEDED_TO from 6 to 8 in iconvdata/iso-2022-cn-ext.c line 60.

PERTAIN_TOProblem

Integer overflow in size calculation in glibc-2.33 wordexp() function. — glibc-2.33 wordexp() function.

PERTAIN_TOSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

PERTAIN_TOProblem

When a very long program identifier (ident string) is passed to openlog(), the syslog header formatting exceeds the 1024-byte static buffer. — glibc's syslog logging subsystem (version 2.37 and earlier). Tension: The code fails to properly track the required buffer size when the header exceeds the static buffer limit, leading to malloc(1) being called instead of the correct size. Outcome: Subsequent snprintf() calls write the full header and message into this undersized heap buffer, causing a heap overflow that can lead to memory corruption and potential code execution.

PERTAIN_TOSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

OCCURS_ONProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

OCCURS_INProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PROVIDED_BYComponent

iconv

IMPLEMENTATION_OFDomain

Memory Safety

IMPLEMENTATION_OFDomain

Operating System Security

AFFECTSRootCause

readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Tension: The buffer is not NUL-terminated before any later string use. Outcome: buffer contents depend on whatever stack bytes follow the copied link data.

AFFECTSRootCause

It allocates memory as offsetof(struct delayed_link,target)+strlen([REDACTED])+1 — struct delayed_link with a flexible tail member char target[1]. Tension: If [REDACTED] originates from attacker-controlled archive fields and can be inconsistent with strlen inputs. Outcome: strcpy can overflow the allocated tail buffer.

AFFECTSSolution

Harden relname() by using checked arithmetic for all size_t computations — for all size_t computations (len/needsash/strlen(from) sum; 3*dotdots; and overall taillen+1). Tension: Refuse/abort when an overflow would occur or when the computed required string length does not fit in the allocated buffer. Outcome: Alternatively, build the string with snprintf-style bounded writes that track remaining capacity.

AFFECTSRootCause

The outer loop fails to advance the read pointer past a value when no separator follows — `if (p[len] != '\0') p += len + 1;`. Tension: the same bytes get re-parsed as a fresh name=value pair on the next iteration while the write cursor `off` keeps growing monotonically. Outcome: Because '=' is not a value terminator (only ':' and '\0' are), a value may legally contain '=' characters.

AFFECTSProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

AFFECTSSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

AFFECTSRootCause

processed twice, first as name=name=val and next as name=val — when a malformed tunable value of the form 'name=name=val' is parsed in the AT_SECURE (setuid) path. Tension: tunestr being name=name=val:name=val, thus overflowing tunestr.

AFFECTSRootCause

`if (dirp == &dir[allocated - 1]) *--dirp = '/';` — sysdeps/posix/getcwd.c, lines 449-450. Tension: When allocated==1 (size==1 passed), dirp is at dir[0]. Outcome: writes '/' ONE BYTE BEFORE the buffer.

AFFECTSRootCause

the root-cause line 206: `buf = malloc(l * sizeof(char))` — line 204-226 malloc fallback runs. Tension: allocates only header size, ignoring vl. Outcome: Compared against upstream glibc 2.39 patch which allocates `(l + vl + 1) * sizeof(char)`.

AFFECTSSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

AFFECTSRootCause

Line 62 contains the vulnerable strcpy(sun.sun_path, hostname). — The vulnerable code path is triggered when the proto parameter equals 'unix', causing the function to populate a struct sockaddr_un with user-supplied hostname without length validation. Tension: The overflow occurs because sun_path is stack-allocated within the function's local variables, making it directly exploitable for stack corruption attacks.

AFFECTSRootCause

the iconv loop framework guarantees to be available before calling the loop body. Outcome: Worst-case output for a single UCS4 character is 8 bytes.

AFFECTSRootCause

Examined iconvdata/iso-2022-cn-ext.c lines 550-600. Outcome: adding `if (outptr + 4 > outend)` checks before escape sequence writes in SS2 and SS3 sections.

AFFECTSRootCause

tunables_strdup() which allocates buffer for environment variable name only — __tunables_init (line 278) calls tunables_strdup().

AFFECTSRootCause

When header exceeds 1024 bytes (l >= sizeof bufs).

AFFECTSRootCause

For tunables whose security_level is NOT SXID_ERASE (e.g. glibc.malloc.mxfast which is SXID_IGNORE). Outcome: The 'off' offset grows past the original allocation, corrupting __minimal_malloc heap right next to ld.so loader data structures.

AFFECTSSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

AFFECTSRootCause

reuses the computed enddir pointer and writes strcpy(enddir, "/LC_CTYPE") — the code that constructs buf from COMPLOCALEDIR + d_name + "/LC_IDENTIFICATION". Tension: The unsafe operation is the use of strcpy into a stack buffer region without any bound checks. Outcome: relying on assumptions about name length and suffix sizes.

AFFECTSSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info