CVE-2019-6488

Published: 18 January 2019

The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.

Priority

Negligible

CVSS 3 base score: 7.8

Status

Package Release Status
eglibc
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 20.10 (Groovy Gorilla) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 LTS (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Ignored

glibc
Launchpad, Ubuntu, Debian
Upstream
Released (2.29)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(2.29-0ubuntu2)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.29-0ubuntu2)
Ubuntu 18.04 LTS (Bionic Beaver) Ignored

Ubuntu 16.04 LTS (Xenial Xerus) Ignored

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Notes

AuthorNote
mdeslaur
only affects x32
we will not be fixing this issue in Ubuntu stable releases,
marking as ignored

References

Bugs