Heap Overflow Vulnerability in GNU Coreutils 'split' Program
Summary
DEBIAN-CVE-2024-0684: A flaw was found in the GNU coreutils "split" program. Affects coreutils versions < 9.5-1. Fixed in 9.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Coreutils is a package that provides basic file, shell, and text manipulation utilities for Unix-like operating systems. It includes essential commands such as 'ls', 'cp', 'mv', and 'split'. The 'split' command is used to divide a file into pieces, which can be useful for managing large files. However, a recent vulnerability has been identified in the 'split' program that could potentially lead to severe consequences if exploited.
Vulnerability Detail
A flaw was discovered in the GNU Coreutils 'split' program, specifically within the line_bytes_split() function. This vulnerability allows for a heap overflow due to user-controlled data that can exceed several hundred bytes in length. If exploited, this could lead to an application crash, resulting in a denial of service. The issue arises from improper handling of input data, which can be manipulated by an attacker to cause the overflow.
How To Fix
Minimum fixed version
9.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'split' command with untrusted input until the package is updated. It is advisable to validate and sanitize any input data before processing it with the 'split' command.
Conclusion
The heap overflow vulnerability in the GNU Coreutils 'split' program poses a significant risk to systems using affected versions. Users are strongly encouraged to update to the patched version to mitigate potential risks. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for coreutils →
FAQ
The vulnerability is a heap overflow in the 'split' program of GNU Coreutils, which can lead to application crashes and denial of service.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to application crashes, resulting in service interruptions and potential data loss.
Yes, a patch is available in version 9.5-1 of the coreutils package. Users should update to this version or later.
If an immediate update is not possible, avoid using the 'split' command with untrusted input and validate all input data.
References
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
