USN-8737-2: GNU C Library vulnerabilities

The strfmon() and strfmon_l() functions in the GNU C Library (glibc) versions 2.38 through 2.44 can write past the end of a caller-supplied buffer when a monetary conversion uses right-justified width padding. The overflow occurs when the destination buffer is large enough for the padding itself but too small for an internal memmove operation, with the field width or format string potentially attacker-influenced or a fixed susceptible pattern in the calling code. Successful exploitation yields out-of-bounds memory writes in the context of the calling application, plausibly causing crashes (denial of service) or, depending on heap layout, code execution. Any Linux application linked against glibc 2.38–2.44 that calls strfmon/strfmon_l with such patterns is affected, though no network-facing application impact was known at publication. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

Do: Apply your distribution's patched glibc packages (e.g., Ubuntu USN-8737-1 / USN-8737-2) or upgrade to a glibc release newer than 2.44, then restart long-running services so they relink against the fixed library. Audit internally developed software for calls to strfmon/strfmon_l with right-justified width padding, especially where monetary format strings or field widths derive from user input, and sanitize or cap those inputs in the interim. Since no network-facing impact is known, prioritize this as routine patching rather than emergency response, but track vendor advisories for newly identified vulnerable applications.

A stack-based buffer overflow (CWE-121) exists in the tdelete function of the GNU C Library versions 2.1 through 2.44, where two rebalancing branches push an entry onto an internal parent-node stack without checking capacity, writing one pointer past the end of an alloca-allocated array. Triggering it requires deleting a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree of at least a million nodes, meaning an attacker would need to drive a very large number of insertions and deletions through an application that uses tsearch/tdelete. The written value is a pointer into a tree node and is not directly attacker controlled, so the most likely outcome is an application crash (low confidentiality/integrity/availability impact per the CVSS 5.6 rating). No affected application in common Linux distributions has been identified, significantly limiting real-world attack surface. No public proof of concept exists and the flaw is not in the CISA KEV catalog.

Do: Apply distribution security updates for glibc as they ship (Ubuntu has published USN-8737-1 and USN-8737-2 covering this issue) rather than waiting for a targeted exploit. Audit any in-house or third-party applications that use tsearch/tdelete on attacker-influenced data, and confirm they cannot accumulate trees of a million or more nodes. Because the written value is not attacker controlled, the primary risk is denial of service via crash, so prioritize patching on long-running services that maintain large search trees.