CVE-2019-7309
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32...
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
CVE-2019-7309- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
CVE-2019-7309- Updated
- 2026-11-02
EUVDEUVD-2019-16853 No score
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
EUVD-2019-16853- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2g8x-3m62-h85f
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32...
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
GHSA-2g8x-3m62-h85f- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
CVE-2019-7309- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7309
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
DEBIAN-CVE-2019-7309- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-7309
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Record
UBUNTU-CVE-2019-7309- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10792-1 No score
glibc-2.34-1.2 on GA media
These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10792-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glibcDebian:12 |
before 2.28-6 | 2.28-6 |
glibcDebian:13 |
before 2.28-6 | 2.28-6 |
glibcDebian:14 |
before 2.28-6 | 2.28-6 |
eglibcUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.17-93ubuntu42.18-0ubuntu12.18-0ubuntu22.18-0ubuntu42.18-0ubuntu5 Show 24 moreShow less2.18-0ubuntu62.18-0ubuntu72.19-0ubuntu22.19-0ubuntu32.19-0ubuntu42.19-0ubuntu52.19-0ubuntu62.19-0ubuntu6.12.19-0ubuntu6.32.19-0ubuntu6.42.19-0ubuntu6.52.19-0ubuntu6.62.19-0ubuntu6.72.19-0ubuntu6.82.19-0ubuntu6.92.19-0ubuntu6.102.19-0ubuntu6.112.19-0ubuntu6.132.19-0ubuntu6.142.19-0ubuntu6.152.19-0ubuntu6.15+esm12.19-0ubuntu6.15+esm22.19-0ubuntu6.15+esm32.19-0ubuntu6.15+esm4 |
None known |
glibcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.21-0ubuntu42.21-0ubuntu52.21-0ubuntu62.23-0ubuntu12.23-0ubuntu2 Show 18 moreShow less2.23-0ubuntu32.23-0ubuntu42.23-0ubuntu52.23-0ubuntu62.23-0ubuntu72.23-0ubuntu92.23-0ubuntu102.23-0ubuntu112.23-0ubuntu11.22.23-0ubuntu11.32.23-0ubuntu11.3+esm12.23-0ubuntu11.3+esm22.23-0ubuntu11.3+esm32.23-0ubuntu11.3+esm52.23-0ubuntu11.3+esm62.23-0ubuntu11.3+esm72.23-0ubuntu11.3+esm82.23-0ubuntu11.3+esm9 |
None known |
glibcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.26-0ubuntu22.26-0ubuntu2.12.27-0ubuntu22.27-0ubuntu32.27-3ubuntu1 Show 11 moreShow less2.27-3ubuntu1.22.27-3ubuntu1.32.27-3ubuntu1.42.27-3ubuntu1.52.27-3ubuntu1.62.27-3ubuntu1.6+esm12.27-3ubuntu1.6+esm22.27-3ubuntu1.6+esm32.27-3ubuntu1.6+esm42.27-3ubuntu1.6+esm52.27-3ubuntu1.6+esm6 |
None known |
glibcopenSUSE:Tumbleweed |
before 2.34-1.2 | 2.34-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7309 is a medium vulnerability (CVSS 5.5) in Gnu Glibc, published February 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in glibc 2.28-6.
References
securityfocus.com/bid/106835
sourceware.org/bugzilla/show_bug.cgi?id=24155
security.gentoo.org/glsa/202006-04
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2019-7309
Show 39 moreShow less
github.com/advisories/GHSA-2g8x-3m62-h85f
security-tracker.debian.org/tracker/CVE-2019-7309
ubuntu.com/security/CVE-2019-7309
cve.org/CVERecord?id=CVE-2019-7309
suse.com/security/cve/CVE-2009-5064