CVE-2017-18269

Impact:
Moderate
Public Date:
2017-12-24
CWE:
CWE-119
Bugzilla:
1580924: CVE-2017-18269 glibc: memory corruption in memcpy-sse2-unaligned.S

The MITRE CVE dictionary describes this issue as:

An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.

Find out more about CVE-2017-18269 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue did not affect the versions of glibc and compat-glibc as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include the vulnerable code.

CVSS v3 metrics

NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.

CVSS3 Base Score 7.3
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Impact Low
Availability Impact Low

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 8 glibc Not affected
Red Hat Enterprise Linux 7 glibc Not affected
Red Hat Enterprise Linux 7 compat-glibc Not affected
Red Hat Enterprise Linux 6 glibc Not affected
Red Hat Enterprise Linux 6 compat-glibc Not affected
Red Hat Enterprise Linux 5 compat-glibc Not affected
Red Hat Enterprise Linux 5 glibc Not affected
Last Modified

CVE description copyright © 2017, The MITRE Corporation