CVE-2017-17426

Published: Dec 5, 2017Modified: May 13, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.

Affected (1)

Products: Gnu: Glibc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	Version 2.26

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (4)

https://sourceware.org/bugzilla/show_bug.cgi?id=22375

Source: cve@mitre.org

ExploitIssue Tracking

https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=34697694e8a93b325b18f25f7dcded55d6baeaf6

Source: cve@mitre.org

https://sourceware.org/bugzilla/show_bug.cgi?id=22375

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=34697694e8a93b325b18f25f7dcded55d6baeaf6

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.