[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250213210318.GE10433@brightrain.aerifal.cx>
Date: Thu, 13 Feb 2025 16:03:19 -0500
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-26519: musl libc: input-controlled out-of-bounds
write primitive in iconv()
On Thu, Feb 13, 2025 at 12:15:54PM -0500, Rich Felker wrote:
> Vulnerability description:
>
> A vulnerability has been identified in musl libc's implementation of
> iconv that can result in out-of-bounds memory writes in applications
> which process untrusted input using iconv and where the input charset
> for the conversion is input-controlled.
>
> In order for the vulnerability to be exposed, an application must call
> iconv_open with an output encoding of UTF-8 and and input encoding of
> EUC-KR, and must subsequently process untrusted input using the
> resulting conversion descriptor. The most common scenario in which
> this occurs is using the declared MIME charset of untrusted input (for
> example, in XML, HTML, or MIME-encoded email) as input to iconv_open
> for converting arbitrary-encoding input to UTF-8.
>
> This issue was discovered and reported by Nick Wellnhofer. It arose as
> a combination of incorrect input byte validation in the EUC-KR
> decoder, and the fact that the UTF-8 output encoder assumed an
> invariant that the input decoder never produces character codes which
> are not valid Unicode Scalar Values.
Addendum: I also have a test program that will check if your iconv is
affected, attached. It runs over all 65536 byte pairs and looks for
bogus changes to the output buffer pointer/remaining.
View attachment "euckr_bug.c" of type "text/plain" (880 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
