CVE-2019-7309
Summary
| CVE | CVE-2019-7309 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-02-03 02:29:00 UTC |
| Updated | 2020-08-24 17:37:00 UTC |
| Description | In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 24155 – (CVE-2019-7309) x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309) | MISC | sourceware.org | Exploit, Issue Tracking, Third Party Advisory |
| GNU glibc CVE-2019-7309 Local Denial of Service Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| H.J. Lu - Re: [PATCH] x86-64 memcmp: Use unsigned Jcc instructions on size | MISC | sourceware.org | Mailing List, Third Party Advisory |
| glibc: Multiple vulnerabilities (GLSA 202006-04) — Gentoo security | GENTOO | security.gentoo.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.