GNU C Library up to 2.29 Regular Expression posix/regexec.c check_dst_limits_calc_pos_1 resource management

Summaryinfo

A vulnerability categorized as problematic has been discovered in GNU C Library up to 2.29. This affects the function check_dst_limits_calc_pos_1 of the file posix/regexec.c of the component Regular Expression Handler. Such manipulation leads to resource management. This vulnerability is documented as CVE-2018-20796. The attack can be executed remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in GNU C Library up to 2.29 (Software Library) and classified as problematic. Affected by this issue is the function check_dst_limits_calc_pos_1 of the file posix/regexec.c of the component Regular Expression Handler. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. CVE summarizes:

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.

The bug was discovered 01/20/2019. The weakness was released 02/26/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is handled as CVE-2018-20796 since 02/25/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

A public exploit has been developed in Regex. The exploit is available at vuldb.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 37 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

(\227|)(\\1\\1|t1|\\\2537)+

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-131215 and VDB-131217. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion