CVE-2020-10029
published 2020-03-04CVE-2020-10029: The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.76%
51.1th percentile
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | glibc | < glibc 2.30-1 (bookworm) | glibc 2.30-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| gnu | glibc | < 2.32.0 | 2.32.0 |
| gnu | glibc | >= 0 < 2.30-1 | 2.30-1 |
| gnu | glibc | >= 0 < 2.30-1 | 2.30-1 |
| gnu | glibc | >= 0 < 2.30-1 | 2.30-1 |
| gnu | glibc | >= 0 < 2.30-1 | 2.30-1 |
| gnu | glibc | >= 0 < 2.23-0ubuntu11.2 | 2.23-0ubuntu11.2 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1.2 | 2.27-3ubuntu1.2 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_glibc_2.28-12_on_cbl_mariner_1.0 | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv5.9MEDIUM
vendor_ubuntu5.9MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
CISA ICS
Siemens SIMATIC S7-1500 TM MFP BIOS
cisa_ics·2023-06-15·CVSS 5.9
[MEDIUM] Siemens SIMATIC S7-1500 TM MFP BIOS
ICS Advisory
##
Siemens SIMATIC S7-1500 TM MFP BIOS
Release DateJune 15, 2023
Alert CodeICSA-23-166-10
## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely / low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 TM MFP
- Vulnerabilities: Improper Input Validation, Out-of-bounds Read, Use After Free, Out-of-bounds Write, Infinite Loop, Reachable Assertion, Off-by-one Error, Incorrect Default Permissions, Double Fr
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2020-07-06·CVSS 5.9
CVE-2017-12133 [MEDIUM] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
Florian Weimer discovered that the GNU C Library incorrectly handled
certain memory operations. A remote attacker could use this issue to cause
the GNU C Library to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-12133)
It was discovered that the GNU C Library incorrectly handled certain
SSE2-optimized memmove operations. A remote attacker could use this issue
to cause the GNU C Library to crash, resulting in a denial of service, or
possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-18269)
It was discovered that the GNU C Library incorrectly handled certain
pathname operati
Microsoft
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern a seen wh
vendor_msrc·2020-03-10·CVSS 5.5
CVE-2020-10029 [MEDIUM] CWE-787 The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern a seen wh
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX i
Red Hat
glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
vendor_redhat·2020-02-12·CVSS 5.5
CVE-2020-10029 [MEDIUM] CWE-121 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability.
Statement: The glibc version shipped with Red Hat Enterprise Linux 8 is compiled using gcc's stack-protector option which mitigates the possibility of code execution le
Debian
CVE-2020-10029: glibc - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack bu...
vendor_debian·2020·CVSS 5.5
CVE-2020-10029 [MEDIUM] CVE-2020-10029: glibc - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack bu...
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
Scope: local
bookworm: resolved (fixed in 2.30-1)
bullseye: resolved (fixed in 2.30-1)
forky: resolved (fixed in 2.30-1)
sid: resolved (fixed in 2.30-1)
trixie: resolved (fixed in 2.30-1)
GHSA
GHSA-68cv-639q-x75m: The GNU C Library (aka glibc or libc6) before 2
ghsa_unreviewed·2022-05-24
CVE-2020-10029 [LOW] CWE-119 GHSA-68cv-639q-x75m: The GNU C Library (aka glibc or libc6) before 2
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
OSV
glibc vulnerabilities
osv·2020-07-06·CVSS 5.9
CVE-2017-12133 [MEDIUM] glibc vulnerabilities
glibc vulnerabilities
Florian Weimer discovered that the GNU C Library incorrectly handled
certain memory operations. A remote attacker could use this issue to cause
the GNU C Library to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-12133)
It was discovered that the GNU C Library incorrectly handled certain
SSE2-optimized memmove operations. A remote attacker could use this issue
to cause the GNU C Library to crash, resulting in a denial of service, or
possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-18269)
It was discovered that the GNU C Library incorrectly handled certain
pathname operations. A remote attacker could use this issue to cause the
GNU C Library to cras
OSV
CVE-2020-10029: The GNU C Library (aka glibc or libc6) before 2
osv·2020-03-04·CVSS 5.5
CVE-2020-10029 [MEDIUM] CVE-2020-10029: The GNU C Library (aka glibc or libc6) before 2
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions [fedora-all]
bugzilla·2020-03-05·CVSS 5.5
CVE-2020-10029 [MEDIUM] CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions [fedora-all]
CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
bugzilla·2020-03-05·CVSS 5.5
CVE-2020-10029 [MEDIUM] CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.
Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25487
Upstream commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=9333498794cde1d5cca518badf79533a24114b6f
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1810671]
---
There's an issue in __ieee754_rem_pio2l() function, where it doesn't validate correctly
Bugzilla
CVE-2020-1752 glibc: use-after-free in glob() function when expanding ~user
bugzilla·2020-03-05·CVSS 7.0
CVE-2020-1752 [HIGH] CVE-2020-1752 glibc: use-after-free in glob() function when expanding ~user
CVE-2020-1752 glibc: use-after-free in glob() function when expanding ~user
It was found a use after free in glob function of glibc when expanding ~user.
Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25414
Upstream commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ddc650e9b3dc916eab417ce9f79e67337b05035c
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1811586]
---
Both glibc and gnulib share the same vulnerable code in glob.c.
Generally speaking, function glob_use_alloca() is used to determine whether an object can be allocated on the stack or not:
```
if (glob_use_alloca(alloca_used, size))
/* use stack */
else
/* use malloc */
```
glob_use_alloca() leverages __libc_use_alloca() to implement the actual check. The key differ
arXiv
ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers
arxiv_fulltext·2022-09-05
ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers
: Guiding Processor Fuzzing using
Control and Status Registers
Sadullah Canakci
[email protected]
Boston University
Boston
USA
Chathura Rajapaksha
[email protected]
Boston University
Boston
USA
Anoop Mysore Nataraja
[email protected]
University of Washington
Seattle
USA
Leila Delshadtehrani
[email protected]
Boston University
Boston
USA
Michael Taylor
[email protected]
University of Washington
Seattle
USA
Manuel Egele
[email protected]
Boston University
Boston
USA
Ajay Joshi
[email protected]
Boston University
Boston
USA
processor, greybox fuzzing, verification, coverage
## Abstract
As the complexity of modern processors has increased over the years, developing
effective verification strategies to identify bugs prior to manufacturing has
become critical.
Undiscovered micro-arc
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.htmlhttps://lists.debian.org/debian-lts-announce/2022/10/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E/https://security.gentoo.org/glsa/202006-04https://security.netapp.com/advisory/ntap-20200327-0003/https://sourceware.org/bugzilla/show_bug.cgi?id=25487https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=9333498794cde1d5cca518badf79533a24114b6fhttps://usn.ubuntu.com/4416-1/http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.htmlhttps://lists.debian.org/debian-lts-announce/2022/10/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E/https://security.gentoo.org/glsa/202006-04https://security.netapp.com/advisory/ntap-20200327-0003/https://sourceware.org/bugzilla/show_bug.cgi?id=25487https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=9333498794cde1d5cca518badf79533a24114b6fhttps://usn.ubuntu.com/4416-1/
2020-03-04
Published