Critical · published July 22, 2021
🔥 Just one untrusted input can bring down the whole system! The wordexp function in glibc is a ticking time bomb that could crash or expose arbitrary memory. ⚠️ Think of it like a restaurant kitchen where a chef accepts any recipe card without checking it first — a dodgy recipe could ruin the entire meal, or worse, expose kitchen secrets! If an attacker crafts a malicious pattern, they could cause a denial of service by crashing the application or even disclose sensitive information from memory. Imagine the chaos when your system just stops working because it couldn't handle a bad order!
Think of it like a restaurant kitchen where a chef accepts any recipe card without checking it first — a dodgy recipe could ruin the entire meal, or worse, expose kitchen secrets! This vulnerability arises in the GNU C Library's wordexp function, due to the improper use of atoi instead of strtoul, leading to unsafe memory access when processing untrusted input.
If an attacker crafts a malicious pattern, they could cause a denial of service by crashing the application or even disclose sensitive information from memory. Imagine the chaos when your system just stops working because it couldn't handle a bad order! To protect your systems, immediately update glibc to version 2.34 or later. Review and sanitize any input that interacts with the wordexp function to prevent untrusted patterns from causing crashes. Make sure to audit your code for similar vulnerabilities! You've got this! Keep that code secure and your systems running smoothly. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| netapp/active_iq_unified_manager | all versions | — |
| netapp/e-series_santricity_os_controller | ≥ 11.0, ≤ 11.70.1 | — |
| netapp/hci_management_node | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| netapp/solidfire | all versions | — |
| gnu/glibc | < 2.31 | 2.31 |
| debian/debian_linux | all versions | — |