Paper/Archive/CVE-2019-1010022

CVE-2019-1010022

GNU C Library glibc — GNU Libc current is affected by: Mitigation bypass.

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.3.883 × 2017.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

Affected

ProductAffectedFixed inSource

glibccurrent (At least as of 2018-02-16)–CNA

SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsourceware.org/bugzilla/show_bug.cgi?id=22850 advisorysecurity-tracker.debian.org/tracker/CVE-2019-1010022 advisoryubuntu.com/security/CVE-2019-1010022 refsourceware.org/bugzilla/show_bug.cgi?id=22850#c3 refcert-portal.siemens.com/productcert/html/ssa-398330.html