CVE-2017-9729 — Uncontrolled Recursion in Uclibc

CWE-674 — Uncontrolled Recursion7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 43.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
UclibcDebian Uclibc
Timeline
PublishedJun 16
Latest updateDec 29

Description

In uClibc 0.9.33.2, there is stack exhaustion (uncontrolled recursion) in the check_dst_limits_calc_pos_1 function in misc/regex/regexec.c when processing a crafted regular expression.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDuclibc/uclibc0.9.33.2
▶debiandebian/uclibc

🔴Vulnerability Details

2
GHSA
GHSA-c2v6-69qq-j8h4: In uClibc 0↗2022-05-13
▶
OSV
CVE-2017-9729: In uClibc 0↗2017-06-16
▶

📋Vendor Advisories

1
Debian
CVE-2017-9729: uclibc - In uClibc 0.9.33.2, there is stack exhaustion (uncontrolled recursion) in the ch...↗2017
▶

📄Research Papers

1
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware↗2022-12-29
▶

💬Community

2
Bugzilla
CVE-2017-9728 CVE-2017-9729 uclibc: Multiple vulnerabilities↗2017-06-21
▶
Bugzilla
CVE-2017-9728 CVE-2017-9729 uclibc: Multiple vulnerabilities [fedora-all]↗2017-06-21
▶