Bug 1222992 (CVE-2024-2961) - VUL-0: CVE-2024-2961: glibc: iconv() function in the GNU C Library may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set
Summary: VUL-0: CVE-2024-2961: glibc: iconv() function in the GNU C Library may overfl...
Status: IN_PROGRESS
Alias: CVE-2024-2961
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Andreas Schwab
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/402445/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-2961:8.2:(AV:N...
Keywords:
Depends on:
Blocks: 1223019
  Show dependency tree / graph
 
Reported: 2024-04-17 19:25 UTC by SMASH SMASH
Modified: 2024-05-21 16:31 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-17 19:25:17 UTC 
From: Adhemerval Zanella Netto <zatrazz () gmail com>
Date: Wed, 17 Apr 2024 14:36:02 -0300





The following security advisories have been published:

GLIBC-SA-2024-0004:
===================
ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence

The iconv() function in the GNU C Library versions 2.39 and older may
overflow the output buffer passed to it by up to 4 bytes when converting
strings to the ISO-2022-CN-EXT character set, which may be used to
crash an application or overwrite a neighbouring variable.

ISO-2022-CN-EXT uses escape sequences to indicate character set changes
(as specified by RFC 1922).  While the SOdesignation has the expected
bounds checks, neither SS2designation nor SS3designation have its;
allowing a write overflow of 1, 2, or 3 bytes with fixed values:
'$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.

CVE-Id: CVE-2024-2961
Public-Date: 2024-04-17
Vulnerable-Commit: 755104edc75c53f4a0e7440334e944ad3c6b32fc (2.1.93-169)
Fix-Commit: f9dc609e06b1136bb0408be9605ce7973a767ada (2.40)
Fix-Commit: 31da30f23cddd36db29d5b6a1c7619361b271fb4 (2.39-31)
Fix-Commit: e1135387deded5d73924f6ca20c72a35dc8e1bda (2.38-66)
Fix-Commit: 89ce64b269a897a7780e4c73a7412016381c6ecf (2.37-89)
Fix-Commit: 4ed98540a7fd19f458287e783ae59c41e64df7b5 (2.36-164)
Fix-Commit: 36280d1ce5e245aabefb877fe4d3c6cff95dabfa (2.35-315)
Fix-Commit: a8b0561db4b9847ebfbfec20075697d5492a363c (2.34-459)
Fix-Commit: ed4f16ff6bed3037266f1fa682ebd32a18fce29c (2.33-263)
Fix-Commit: 682ad4c8623e611a971839990ceef00346289cc9 (2.32-140)

Reported-By: Charles Fol

Notes:
======

Published advisories are available directly in the project git repository:
https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2961
https://seclists.org/oss-sec/2024/q2/137
Comment 4 OBSbugzilla Bot 2024-04-18 16:15:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1222992) was mentioned in
https://build.opensuse.org/request/show/1168904 Factory / glibc
Comment 5 Maintenance Automation 2024-04-22 16:30:06 UTC 
SUSE-SU-2024:1375-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1222992
CVE References: CVE-2024-2961
Maintenance Incident: [SUSE:Maintenance:33443](https://smelt.suse.de/incident/33443/)
Sources used:
openSUSE Leap 15.3 (src):
 glibc-2.31-150300.74.1, glibc-testsuite-src-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
openSUSE Leap Micro 5.3 (src):
 glibc-2.31-150300.74.1
openSUSE Leap Micro 5.4 (src):
 glibc-2.31-150300.74.1
openSUSE Leap 15.5 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src):
 glibc-2.31-150300.74.1
SUSE Linux Enterprise Micro 5.3 (src):
 glibc-2.31-150300.74.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src):
 glibc-2.31-150300.74.1
SUSE Linux Enterprise Micro 5.4 (src):
 glibc-2.31-150300.74.1
SUSE Linux Enterprise Micro 5.5 (src):
 glibc-2.31-150300.74.1
Basesystem Module 15-SP5 (src):
 glibc-2.31-150300.74.1
Development Tools Module 15-SP5 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Manager Proxy 4.3 (src):
 glibc-2.31-150300.74.1
SUSE Manager Retail Branch Server 4.3 (src):
 glibc-2.31-150300.74.1
SUSE Manager Server 4.3 (src):
 glibc-2.31-150300.74.1
SUSE Enterprise Storage 7.1 (src):
 glibc-2.31-150300.74.1, glibc-utils-src-2.31-150300.74.1
SUSE Linux Enterprise Micro 5.1 (src):
 glibc-2.31-150300.74.1
SUSE Linux Enterprise Micro 5.2 (src):
 glibc-2.31-150300.74.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 glibc-2.31-150300.74.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Maintenance Automation 2024-05-17 08:30:02 UTC 
SUSE-SU-2024:1675-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1222992, 1223423, 1223424, 1223425
CVE References: CVE-2024-2961, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602
Maintenance Incident: [SUSE:Maintenance:33854](https://smelt.suse.de/incident/33854/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 glibc-2.22-114.34.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 glibc-2.22-114.34.1
SUSE Linux Enterprise Server 12 SP5 (src):
 glibc-2.22-114.34.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 glibc-2.22-114.34.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Maintenance Automation 2024-05-21 16:31:13 UTC 
SUSE-SU-2024:1728-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1222992
CVE References: CVE-2024-2961
Maintenance Incident: [SUSE:Maintenance:33867](https://smelt.suse.de/incident/33867/)
Sources used:
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE 11-SP4 (src):
 glibc-2.11.3-17.110.52.1
SUSE Linux Enterprise Server 11 SP4 (src):
 glibc-2.11.3-17.110.52.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.