CVE-2024-0684 Coreutils: heap overflow in split --line-bytes with very long lines

2024-02-0608:26:58

CWE-122

fedora

github.com

cve-2024-0684

coreutils

heap overflow

split --line-bytes

denial of service

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A flaw was found in the GNU coreutils “split” program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.

CNA Affected

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "v9.2"
      },
      {
        "status": "affected",
        "version": "v9.3"
      },
      {
        "status": "affected",
        "version": "v9.4"
      },
      {
        "status": "unaffected",
        "version": "v9.5"
      }
    ],
    "packageName": "coreutils",
    "collectionURL": "https://git.savannah.gnu.org/gitweb/?p=coreutils.git",
    "defaultStatus": "unaffected"
  }
]