Log in Start free

Vulnerability · Published Dec 5, 2020 · Assigned by mitre

CVE-2020-29573

High 7.5

In plain English

A high-severity security flaw in the glibc package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.7%top 13.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glibc2.23-1DEBIAN-CVE-2020-29573
Debian:13glibc2.23-1DEBIAN-CVE-2020-29573
Debian:14glibc2.23-1DEBIAN-CVE-2020-29573

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References