CVE-2018-6485 Integer overflow in n/a

Critical 9.8 Published 1 Feb 2018 Updated 5 Aug 2024

An integer overflow in glibc's posix_memalign can cause heap corruption, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-6485?

CVE-2018-6485 is a critical vulnerability in Gnu Glibc, published on 1 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

Weakness: CWE-787, CWE-190

Which versions are affected by CVE-2018-6485?

It affects 15 products.

Products include Gnu Glibc, Netapp Cloud Backup, Netapp Data Ontap Edge, Netapp Element Software, Netapp Element Software Management, Netapp Steelstore Cloud Integrated Storage and 9 more.

How do I fix CVE-2018-6485?

Apply the vendor's patch.

Is CVE-2018-6485 being exploited?

There is no known exploitation of CVE-2018-6485 in the wild and no public exploit code.

All Gnu Glibc vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-6485, GHSA-m775-r988-g6m4, UBUNTU-CVE-2018-6485, USN-4218-1.