CVE-2018-1000001

Published: 11 January 2018

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

From the Ubuntu security team

libc does not account for all the possible return values from the kernel getcwd(2) syscall; arbitrary code execution may result from applications making further assumptions on the return value from the getcwd(3) libary function.

Priority

High

CVSS 3 base score: 7.8

Status

Notes

I wonder where Go, busybox, and similar "do it ourselves" tools fit.
I added dietlibc and musl to this page out of an abundance of caution. Someone
should investigate.

introduced a regression in glusterfs geo-rep due to its usage
of rsync. See redhat bug for compensating patch for rsync.

Unlike in glibc, this issue does not cause a buffer underflow in
musl. Furthermore, realpath() does not call getcwd() in musl.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000001
• http://www.openwall.com/lists/oss-security/2018/01/11/5
• https://sourceware.org/bugzilla/show_bug.cgi?id=18203
• https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
• https://ubuntu.com/security/notices/USN-3534-1
• https://ubuntu.com/security/notices/USN-3536-1
• https://lists.samba.org/archive/rsync/2018-February/031478.html
• NVD
• Launchpad
• Debian

Bugs

• https://sourceware.org/bugzilla/show_bug.cgi?id=22679
• https://bugs.launchpad.net/bugs/1746995
• https://bugzilla.redhat.com/show_bug.cgi?id=1542180