Integer Overflow Vulnerability in GLib Package Could Lead to Memory Corruption
Summary
ALPINE-CVE-2021-27219: An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Affects glib versions < 2.66.6-r0. Fixed in 2.66.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GLib is a low-level core library that forms the basis for projects such as GTK and GNOME. It provides data structures, utility functions, and object-oriented programming capabilities in C. This library is widely used in various applications, making its security crucial. The vulnerability in question affects versions of GLib prior to 2.66.6 and 2.67.x before 2.67.3, exposing applications to potential memory corruption due to an integer overflow.
Vulnerability Detail
An issue was discovered in GNOME GLib before version 2.66.6 and 2.67.x before 2.67.3. The vulnerability arises from the function g_bytes_new, which experiences an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. This overflow can lead to memory corruption, potentially allowing attackers to exploit the vulnerability for malicious purposes.
How To Fix
Minimum fixed version
2.66.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade glibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of the g_bytes_new function in your application until the package is updated. Review your code to identify any instances where this function is called and replace it with a safer alternative if possible.
Conclusion
The integer overflow vulnerability in the GLib package poses a significant risk to applications utilizing this library. It is essential to update to the patched version to mitigate the risk of memory corruption and potential exploitation. Regular monitoring and updates are crucial for maintaining software security.
See every vulnerability recorded for glib →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
GLib versions before 2.66.6 and 2.67.x before 2.67.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to memory corruption, which may allow attackers to execute arbitrary code or crash the application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for glib.
