CVE-2013-4788
published 2013-10-04CVE-2013-4788: The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random…
PriorityP338medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
11.43%
95.5th percentile
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.17-94 (bookworm) | glibc 2.17-94 (bookworm) |
| gnu | glibc | <= 2.17 | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
osv5.1MEDIUM
vendor_debian5.1LOW
vendor_redhat5.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xh2f-h76w-4qqc: The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2
ghsa_unreviewed·2022-05-17
CVE-2013-4788 [MEDIUM] CWE-20 GHSA-xh2f-h76w-4qqc: The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.
OSV
CVE-2013-4788: The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2
osv·2013-10-04·CVSS 5.1
CVE-2013-4788 [MEDIUM] CVE-2013-4788: The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.
Red Hat
glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables
vendor_redhat·2013-07-15·CVSS 5.1
CVE-2013-4788 [MEDIUM] glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables
glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.
Statement: Red Hat Security Response Team has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 5 and 6. For additional information, refer to the Issue Severity Classification: https:/
Debian
CVE-2013-4788: glibc - The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.1...
vendor_debian·2013·CVSS 5.1
CVE-2013-4788 [MEDIUM] CVE-2013-4788: glibc - The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.1...
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.
Scope: local
bookworm: resolved (fixed in 2.17-94)
bullseye: resolved (fixed in 2.17-94)
forky: resolved (fixed in 2.17-94)
sid: resolved (fixed in 2.17-94)
trixie: resolved (fixed in 2.17-94)
No detection rules found.
Bugzilla
glibc: Bypass the pointer guarding protection on set-user-ID and set-group-ID executables (PTR_MANGLE)
bugzilla·2016-01-19·CVSS 5.1
CVE-2013-4788 [MEDIUM] glibc: Bypass the pointer guarding protection on set-user-ID and set-group-ID executables (PTR_MANGLE)
glibc: Bypass the pointer guarding protection on set-user-ID and set-group-ID executables (PTR_MANGLE)
A weakness was found in the dynamic loader in glibc prior to 2.22.90. LD_POINTER_GUARD in the enivronment was not sanitized, allowing local attackers to bypass the pointer guarding protection on set-user-ID and set-group-ID executables.
This is a different security flaw then CVE-2013-4788, and only executables which dynamically link against glibc are affected.
This issue has been fixed upstream via the following commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=a014cecd82b71b70a6a843e250e06b541ad524f7
External References:
http://hmarco.org/bugs/glibc_ptr_mangle_weakness.html
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1299755
Bugzilla
glibc: CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables [fedora-all]
bugzilla·2013-07-31·CVSS 5.1
CVE-2013-4788 [MEDIUM] glibc: CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables [fedora-all]
glibc: CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog an
Bugzilla
CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables
bugzilla·2013-07-17·CVSS 5.1
CVE-2013-4788 [MEDIUM] CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables
CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables
It was reported [1],[2] that glibc and eglibc suffer from a flaw due to the PTR_MANGLE implementations. As described by the reporter:
The vulnerability is caused due to the non initialization to a random value (it is always zero) of the "pointer guard" by the glibc only when generating static compiled executables. Dynamic executables are not affected. Pointer guard is used to mangle the content of sensible pointers (longjmp, signal handlers, etc.), if the pointer guard value is zero (non-initialized) then it is not effective.
An example:
Library functions like "setjmp()" or "longjmp()" use PTR_MANGLE and PTR_DEMANGLE. These macros are used to protect structures l
http://hmarco.org/bugs/CVE-2013-4788.htmlhttp://seclists.org/fulldisclosure/2015/Sep/23http://www.mandriva.com/security/advisories?name=MDVSA-2013:283http://www.mandriva.com/security/advisories?name=MDVSA-2013:284http://www.openwall.com/lists/oss-security/2013/07/15/9http://www.securityfocus.com/bid/61183https://security.gentoo.org/glsa/201503-04http://hmarco.org/bugs/CVE-2013-4788.htmlhttp://seclists.org/fulldisclosure/2015/Sep/23http://www.mandriva.com/security/advisories?name=MDVSA-2013:283http://www.mandriva.com/security/advisories?name=MDVSA-2013:284http://www.openwall.com/lists/oss-security/2013/07/15/9http://www.securityfocus.com/bid/61183https://security.gentoo.org/glsa/201503-04
2013-10-04
Published