Integer Overflow Vulnerability in libgc Package: Memory Allocation Flaws
Summary
DEBIAN-CVE-2012-2673: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easie... Affects libgc versions < 1:7.1-9. Fixed in 1:7.1-9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libgc, also known as the Boehm-Demers-Weiser garbage collector, is a widely used memory management library in C and C++ programming. It provides automatic memory management, allowing developers to allocate and free memory without manual intervention. However, prior to version 7.2, libgc is susceptible to multiple integer overflow vulnerabilities that can lead to serious memory-related attacks.
Vulnerability Detail
Multiple integer overflows in the GC_generic_malloc and calloc functions in malloc.c, as well as the GC_generic_malloc_ignore_off_page function in mallocx.c, make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows. This occurs when a large size value is provided, resulting in less memory being allocated than expected, which can lead to unpredictable behavior and potential exploitation.
How To Fix
Minimum fixed version
1:7.1-9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libgcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected functions with untrusted input or implement input validation to restrict size values to safe limits. However, this is not a substitute for applying the patch.
Conclusion
The integer overflow vulnerability in the libgc package poses significant risks to applications relying on this library for memory management. It is crucial to update to the patched version to safeguard against potential memory-related attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libgc →
FAQ
The integer overflow can lead to buffer overflows, allowing attackers to manipulate memory allocation, potentially leading to arbitrary code execution.
All versions of libgc prior to 7.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While the best solution is to update to the patched version, you can implement input validation as a temporary measure to mitigate risks.
Detailed information can be found in the Debian CVE database and other security advisories related to libgc.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
