CVE-2025-0395

Published: Jan 22, 2025Modified: Jun 17, 2026Deferred

6.2

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.5 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

Related CWEs

Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

References (12)

https://sourceware.org/bugzilla/show_bug.cgi?id=32582

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2025-0001

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

https://sourceware.org/pipermail/libc-announce/2025/000044.html

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

https://www.openwall.com/lists/oss-security/2025/01/22/4

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

http://www.openwall.com/lists/oss-security/2025/01/22/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/01/23/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/04/13/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/04/24/7

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/04/msg00039.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20250228-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

https://cert-portal.siemens.com/productcert/html/ssa-577017.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.