Heap Overflow Vulnerability in Coreutils: Denial of Service Risk
Summary
UBUNTU-CVE-2024-0684: A flaw was found in the GNU coreutils "split" program. Affects coreutils versions < 9.4-2ubuntu3. Fixed in 9.4-2ubuntu3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Coreutils is a fundamental package in the GNU operating system that provides essential utilities for file manipulation, text processing, and system management. It includes commands like 'ls', 'cp', 'mv', and 'split', which are crucial for everyday tasks in Unix-like environments. The package is widely used across various Linux distributions, including Ubuntu. The vulnerability in question affects the 'split' program within Coreutils, which is used to split files into smaller pieces. This vulnerability could lead to serious issues if exploited, as it allows for potential application crashes and denial of service.
Vulnerability Detail
A flaw was discovered in the GNU coreutils 'split' program, specifically in the line_bytes_split() function. This flaw is characterized by a heap overflow that can occur when handling user-controlled data, potentially reaching multiple hundred bytes in length. If exploited, this vulnerability could lead to an application crash, resulting in a denial of service. The vulnerability is identified as CVE-2024-0684 and has a CVSS score of 5.5, indicating a medium severity level. The issue arises from improper handling of memory allocation, allowing attackers to manipulate the program's behavior.
How To Fix
Minimum fixed version
9.4-2ubuntu3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'split' command with untrusted input until the package is updated. This can help prevent potential exploitation of the vulnerability while waiting for a permanent fix.
Conclusion
The heap overflow vulnerability in the Coreutils package, specifically affecting the 'split' program, poses a risk of application crashes and denial of service. Users are advised to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for coreutils →
FAQ
CVE-2024-0684 is a vulnerability in the GNU coreutils 'split' program that can lead to a heap overflow, potentially causing application crashes and denial of service.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability has a CVSS score of 5.5, indicating a medium severity level, which means it poses a moderate risk to systems using the affected package.
If you cannot update the package right away, avoid using the 'split' command with untrusted input as a temporary workaround to mitigate the risk.
More information can be found in the official Ubuntu security notices or by visiting the GitHub repository for detailed vulnerability reports.
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
