Arbitrary Code Execution Vulnerability in newlib Package
Summary
DEBIAN-CVE-2024-30949: An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function. Affects newlib versions < 4.4.0.20231231-2. Fixed in 4.4.0.20231231-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
newlib is a C library intended for use on embedded systems. It provides a lightweight implementation of standard C library functions, making it suitable for resource-constrained environments. The library is widely used in various applications, including firmware and operating systems. However, a recent vulnerability has been identified that could allow attackers to exploit the library's time unit scaling functionality.
Vulnerability Detail
An issue in newlib version 4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function. This vulnerability arises from improper handling of time values, which could lead to unexpected behavior and potential exploitation. If successfully exploited, an attacker could gain unauthorized access to the system, leading to data breaches or system compromise.
How To Fix
Minimum fixed version
4.4.0.20231231-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade newlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the affected functionality or restricting access to the affected components until the package can be updated. However, this is not a permanent solution and should be addressed by applying the patch as soon as possible.
Conclusion
In summary, the newlib package has a vulnerability that allows for arbitrary code execution due to improper handling of time values in the _gettimeofday function. It is crucial to update to the patched version to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for newlib →
FAQ
The urgency of this vulnerability is classified as unimportant, but it still poses a risk of arbitrary code execution.
The vulnerability affects newlib versions prior to 4.4.0.20231231-2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially leading to unauthorized access and system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for newlib.
