CVE-2020-6096

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Security fixes:

• fix buffer overrun in EUC-KR conversion module [bz #2497] (CVE-2019-25013)
• arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620]
• arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]
• iconv: Fix incorrect UCS4 inner loop bounds [BZ #26923] (CVE-2020-29562) other upstream fixes:
• libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203]
• string.h: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]
• misc/test-errno-linux: Handle EINVAL from quotactl
• nss_compat: internal_end*ent may clobber errno, hiding ERANGE [BZ #25976]
• Fix avx2 strncmp offset compare condition check [BZ #25933]
• AArch64: Align ENTRY to a cacheline
• AArch64: Add optimized Q-register memcpy
• AArch64: Improve backwards memmove performance
• AArch64: Rename IS_ARES to IS_NEOVERSE_N1
• AArch64: Increase small and medium cases for __memcpy_generic
• AArch64: Improve integer memcpy
• AArch64: Use __memcpy_simd on Neoverse N2/V1
• AArch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
• AArch64: fix stack missing after sp is updated
• x86-64: Avoid rep movsb with short distance [BZ #27130]
• x86: Assume --enable-cet if GCC defaults to CET [BZ #25225]
• x86: Check IFUNC definition in unrelocated executable [BZ #20019]
• x86: Set header.feature_1 in TCB for always-on CET [BZ #27177]
• Fix parsing of /sys/devices/system/cpu/online [BZ #25859]
• Use O_CLOEXEC in sysconf [BZ #26791]

These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.

Jason Royes and Samuel Dytrych discovered that the memcpy() implementation for 32 bit ARM processors in the GNU C Library contained an integer underflow vulnerability. An attacker could possibly use this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2020-6096)

It was discovered that the POSIX regex implementation in the GNU C Library did not properly parse alternatives. An attacker could use this to cause a denial of service. (CVE-2009-5155)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-6096)

It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-35942)

It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10. (CVE-2021-3998)

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3999)

It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2022-23218, CVE-2022-23219)