CVE-2017-17426
published 2017-12-05CVE-2017-17426: The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object…
PriorityP339high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
1.60%
73.2th percentile
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | — | — |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.14 | 2.19-0ubuntu6.14 |
| gnu | glibc | — | — |
| gnu | glibc | >= 0 < 2.23-0ubuntu10 | 2.23-0ubuntu10 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1 | 2.27-3ubuntu1 |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1LOW
vendor_redhat8.1HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2018-01-17·CVSS 7.8
CVE-2017-1000408 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in the GNU C library.
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
A memory leak was discovered in the _dl_init_paths() function in the GNU
C library dynamic loader. A local attacker could potentially exploit this
with a specially crafted value in the LD_HWCAP_MASK environment variable,
in combination with CVE-2017-1000409 and another vulnerability on a system
with hardlink protections disabled, in order to gain administrative
privileges. (CVE-2017-1000408)
A heap-based buf
Red Hat
glibc: Integer overflow with enabled tcache
vendor_redhat·2017-10-31·CVSS 8.1
CVE-2017-17426 [HIGH] CWE-190 glibc: Integer overflow with enabled tcache
glibc: Integer overflow with enabled tcache
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
Package: compat-glibc (Red Hat Enterprise Linux 5) - Not affected
Package: glibc (Red Hat Enterprise Linux 5) - Not affected
Package: compat-glibc (Red Hat Enterprise Linux 6) - Not affected
Package: glibc (Red Hat Enterprise Linux 6) - Not affected
Package: compat-glibc (Red Hat Enterprise Linux 7) - Not affected
Package: glibc (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2017-17426: glibc - The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return ...
vendor_debian·2017·CVSS 8.1
CVE-2017-17426 [HIGH] CVE-2017-17426: glibc - The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return ...
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-5rxv-m65f-6q4g: The malloc function in the GNU C Library (aka glibc or libc6) 2
ghsa_unreviewed·2022-05-17
CVE-2017-17426 [HIGH] CWE-190 GHSA-5rxv-m65f-6q4g: The malloc function in the GNU C Library (aka glibc or libc6) 2
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
OSV
eglibc, glibc vulnerabilities
osv·2018-01-17·CVSS 7.8
CVE-2018-1000001 [HIGH] eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
A memory leak was discovered in the _dl_init_paths() function in the GNU
C library dynamic loader. A local attacker could potentially exploit this
with a specially crafted value in the LD_HWCAP_MASK environment variable,
in combination with CVE-2017-1000409 and another vulnerability on a system
with hardlink protections disabled, in order to gain administrative
privileges. (CVE-2017-1000408)
A heap-based buffer overflow was discovered in the _dl_init_paths()
function in the GNU C
OSV
CVE-2017-17426: The malloc function in the GNU C Library (aka glibc or libc6) 2
osv·2017-12-05·CVSS 8.1
CVE-2017-17426 [HIGH] CVE-2017-17426: The malloc function in the GNU C Library (aka glibc or libc6) 2
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-17426 glibc: Integer overflow with enabled tcache
bugzilla·2017-12-11·CVSS 8.1
CVE-2017-17426 [HIGH] CVE-2017-17426 glibc: Integer overflow with enabled tcache
CVE-2017-17426 glibc: Integer overflow with enabled tcache
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
Upstream issue:
https://sourceware.org/bugzilla/show_bug.cgi?id=22375
Upstream patch:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=34697694e8a93b325b18f25f7dcded55d6baeaf6
Introduced by:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d5c3fafc4307c9b7a4c7d5cb381fcdbfad340bcc
CTF
2020-PoseidonCTF / README
ctf_writeups·2020·CVSS 8.1
[HIGH] 2020-PoseidonCTF / README
# PoseidonCTF
Good quality CTF from `From Sousse, with love`. DiceGang takes second.
Notably I helped with 1 heap, which got 4-5 solves. Unfortunately I had to go to sleep right before getting libc leaks so OP pepsi on the West Coast solved submitted, but I solved afterwards for fun.
## OldNote
> Old, but gold
>
> nc poseidonchalls.westeurope.cloudapp.azure.com 9000
Full security checks are in place, so it's a heap chall. The provided libc and ld are for glibc 2.26, which has tcache included.
The program allows us 4 slots which hold pointers to malloc'ed chunks. We can only create and delete these chunks, so no easy :leeks:
We also cannot allocate chunks larger than 0x100 size.
### Vuln
The issue comes down to how the sizes are read. The function to read an int uses atoi, which
2017-12-05
Published