REDHAT-BUG-2492248: Medium severity GLib GIO (g_io_channel) vulnerability
A heap-buffer-overflow READ occurs in giochannelreadlinebackend() at giochannel.c:1831 when a custom line terminator of length > 1 is set via giochannelsetlineterm(). The memcmp call reads linetermlen bytes from nextchar, but the loop condition nextchar < lastchar only guarantees 1 byte is available. When nextchar is within linetermlen - 1 bytes of lastchar, memcmp reads past the GString buffer into ASan redzone / unallocated memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2492248?
The severity of REDHAT-BUG-2492248 is medium, rated at 4.
How do I fix REDHAT-BUG-2492248?
To fix REDHAT-BUG-2492248, you should update to the latest version of GLib GIO that addresses this vulnerability.
What type of vulnerability is REDHAT-BUG-2492248?
REDHAT-BUG-2492248 is classified as a heap-buffer-overflow READ vulnerability.
What specific function is affected by REDHAT-BUG-2492248?
The function affected by REDHAT-BUG-2492248 is g_io_channel_read_line_backend() in giochannel.c.
What conditions lead to the vulnerability in REDHAT-BUG-2492248?
The vulnerability in REDHAT-BUG-2492248 occurs when a custom line terminator of length greater than 1 is set via g_io_channel_set_line_term().