CVE-2024-1013 Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
An out-of-bounds stack write in unixODBC on 64-bit systems allows attackers to potentially execute code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-1013?
CVE-2024-1013 is a high-severity memory corruption vulnerability in Red Hat Enterprise Linux 6, published on 18 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
Weakness: CWE-823
Which versions are affected by CVE-2024-1013?
1 open source package ship an affected version, including unixodbc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
unixodbc Bitnami | All versions | None |
Linux distribution packages (3)
unixODBC SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.3.9-7.16.1 |
unixODBC SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.3.9-7.16.1 |
unixODBC SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.3.9-7.16.1 |
Products include Unixodbc Unixodbc.
How do I fix CVE-2024-1013?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-1013 being exploited?
There is no known exploitation of CVE-2024-1013 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Enterprise Linux 6
Sources
Also known as AZL-36896, AZL-36904, BIT-unixodbc-2024-1013, CLSA-2024-1712261674, CLSA-2024-1712262573, CLSA-2024-1712263690 and 21 more.