GMP: Buffer Overflow Vulnerability

Background

The GNU Multiple Precision Arithmetic Library is a library forarbitrary-precision arithmetic on different types of numbers.

Description

There is an integer overflow leading to a buffer overflow when processing untrusted input via GMP’s mpz_inp_raw function.

Impact

Untrusted input can cause a denial of service via segmentation fault.

Workaround

Users can ensure no untrusted input is passed into GMP’s mpz_inp_raw function.

Resolution

All GMP users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-libs/gmp-6.2.1-r2"