CVE-2025-0395

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 to 2.42 may result in an integer overflow, which could consequently result in heap corruption. To exploit this, an attacker must control both the size and alignment arguments; the size must be close to PTRDIFF_MAX and the alignment in the range [1<<62+1, 1<<63] (exactly 1<<63 for posix_memalign and aligned_alloc). In practice, alignment is typically not attacker-controlled, making exploitation unlikely.

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() with a negative value for the 'num' parameter results in a signed comparison vulnerability, potentially leading to out-of-bounds memory writes and remote code execution.

In the GNU C Library (glibc) through version 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This occurs when attacker-controlled input strings match up to the edge of their page and the neighboring page is either not mapped or not readable.

Initializing the DNS stub resolver from /etc/resolv.conf or LOCALDOMAIN with a search list containing a domain of roughly 200 characters or more in GNU C Library versions 2.26 to 2.44 results in an assertion failure that aborts the process. The resolver truncates the search list when copying into the fixed-size _res.defdname buffer, but the consistency check compares against the wrong size and does not handle a first entry that does not fit, causing the assertion to fail.