CyberRota Analysis
AI-GeneratedA stack-based buffer overflow vulnerability exists in the dynamic loader of the GNU C Library, affecting versions 2.14 through 2.44. This flaw allows local attackers to crash or corrupt memory in setuid/setgid programs, particularly when the program's DT_RPATH or DT_RUNPATH is improperly configured. Organizations utilizing these versions of glibc, especially those running sensitive applications with elevated privileges, should prioritize addressing this vulnerability to mitigate potential denial of service and memory disclosure risks.
Original NVD Description
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.