Real Exploit
Estimate Time: 4 min read
Linux systems rely on shared software libraries to provide common functions to
applications. One such library, the GNU C Library (glibc), includes iconv, a function
that converts text from one character encoding to another.
A conversion may need to add special bytes to the output, so iconv must keep every
write within the output buffer’s available space.
A text converter in glibc could write past the end of its output buffer because some writes lacked a capacity check. The issue was recorded as CVE-2024-2961.
Timeline
April 2024
|
| The vulnerability and upstream fix were publicly discussed on the Openwall oss-security mailing list.
|
April–May 2024
|
| Major Linux distribution vendors released patched packages, including backported fixes for supported versions.
About glibc
glibc is a core software library used by most Linux systems. Programs rely on it for common operations, including handling files, memory, and text. A problem in glibc can therefore affect many different applications, even when those applications do not implement the affected feature themselves.
The part involved in this case is iconv, which converts text between character
encodings. An application might use it to prepare text for a system or service that
expects a different encoding.
One of the encodings it can handle is ISO-2022-CN-EXT, which uses special byte sequences
to mark changes in how characters are represented.
Applications such as PHP can use glibc’s conversion functions, so a request handled by
an application may reach this library indirectly.
Character encoding — A system for representing text as data. Different encodings can represent characters in different ways, so software may need to convert text when moving it between systems.
The Vulnerability
A text conversion routine has to check output capacity for both converted characters and additional data required by the destination encoding.
During a normal conversion, iconv reads text and writes the converted result into an
output buffer. A buffer is a reserved area of memory with a limited capacity.
The converter must check that enough room remains before writing each part of the
result, including any special escape sequences required by an encoding.
This is an out-of-bounds write, also known as CWE-787. The converter was
supposed to keep its writes within the buffer, but the missing checks allowed it to
alter nearby memory.
Depending on the application and memory layout, this could cause a crash or other memory
corruption. Under suitable conditions, researchers showed that the corruption could
contribute to code execution when combined with other capabilities or weaknesses.
It did not mean that every use of iconv, or every affected system, could automatically
be taken over.
What Was Documented
Public security analysis documented crashes and more serious consequences in certain application environments. The library-level flaw is an out-of-bounds write. Its effects depend on how the host application uses the converter and what memory is nearby.
Why It Mattered
glibc is widely used, and applications may call its conversion functions without their users knowing that the library is involved. That makes a flaw in a shared library important: many kinds of programs, including server-side software, could be exposed if they used the affected conversion and accepted input that reached it. The encoding was less common than UTF-8, but it was available on some systems, including through additional character-conversion packages.
Mitigation
Install the patched glibc package for the operating system and restart affected services as directed by the vendor.
Use the patched glibc package from your distribution. Identify processes that need a restart to load the updated library.