GNU C Library 2.40 on Power10 control flow

Summaryinfo

A vulnerability was found in GNU C Library 2.40 on Power10. It has been classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to control flow. This vulnerability is uniquely identified as CVE-2025-5745. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in GNU C Library 2.40 on Power10. This issue affects an unknown code block. The manipulation with an unknown input leads to a control flow vulnerability. Using CWE to declare the problem leads to CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

It is possible to read the advisory at sourceware.org. The identification of this vulnerability is CVE-2025-5745 since 06/05/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/09/2025).

The vulnerability scanner Nessus provides a plugin with the ID 240529 (Fedora 41 : glibc (2025-e489437b3d)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (240529), EUVD (EUVD-2025-17018) and CERT Bund (WID-SEC-2025-1252). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• Oracle Linux
• Open Source GNU libc
• IBM App Connect Enterprise

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

Version

• 2.40

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion