CVE-2019-7309

CVE-2019-7309

Medium · published February 3, 2019

CVSS v3.0
5.5
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

The record
Technical detail
CVSS v3.0
5.5 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00607 · 48.4th percentile
Published
2019-02-03T07:29Z
Affected products (1)
ProductVersionsFixed in
gnu/glibc≤ 2.29—
References (9)
http://www.securityfocus.com/bid/106835 · [email protected]https://security.gentoo.org/glsa/202006-04 · [email protected]https://sourceware.org/bugzilla/show_bug.cgi?id=24155 · [email protected]https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html · [email protected]http://www.securityfocus.com/bid/106835 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-04 · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/bugzilla/show_bug.cgi?id=24155 · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 03 FEB 02:00Z
    In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs…
    cvelistv5