CVE-2024-2961 Memory corruption in glibc
A buffer overflow in glibc's iconv function allows attackers to crash applications or potentially execute code via crafted ISO-2022-CN-EXT strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2961?
CVE-2024-2961 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Weakness: CWE-787
Which versions are affected by CVE-2024-2961?
It affects 13 products.
Linux distribution packages (40)
compat-libpthread-nonshared AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
compat-libpthread-nonshared AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-all-langpacks AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-all-langpacks AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-benchtests AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-benchtests AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-common AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-common AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-devel AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-devel AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-doc AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-doc AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-gconv-extra AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-gconv-extra AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-headers AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-headers AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-aa AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-aa AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-af AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-af AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-agr AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-agr AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-ak AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-ak AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-am AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-am AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-an AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-an AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-anp AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-anp AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-ar AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-ar AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-as AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-as AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-ast AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-ast AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
glibc-langpack-ayc AlmaLinux:8 | All versions | 2.28-236.el8_9.13 |
glibc-langpack-ayc AlmaLinux:8 | All versions | 2.28-251.el8_10.1 |
Products include Debian Debian Linux, Gnu Glibc, Netapp Active Iq Unified Manager, Netapp Hci Compute Node, Netapp Hci H300s Firmware, Netapp Hci H410c Firmware and 7 more.
How do I fix CVE-2024-2961?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-2961 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2961 exists.
Public exploit code: 1 Metasploit module and 17 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2024:2722, ALSA-2024:3269, BELL-CVE-2024-2961, CLSA-2024-1717691587, CLSA-2024-1718024371, CLSA-2024-1718790660 and 21 more.