CVE-2020-29573
Last modified
CVE-2020-29573 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. EPSS estimates a 2.77% chance of exploitation in the next 30 days.
Description
sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Glibc | < 2.23 |
| Redhat | Enterprise Linux | 7.0 |
| Netapp | Cloud Backup | All versions |
| Netapp | Solidfire Baseboard Management Controller | All versions |
References
- https://security.gentoo.org/glsa/202101-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210122-0004/Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=26649Issue Tracking, Patch, Third Party Advisory
- https://sourceware.org/pipermail/libc-alpha/2020-September/117779.htmlPatch, Third Party Advisory
- https://security.gentoo.org/glsa/202101-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210122-0004/Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=26649Issue Tracking, Patch, Third Party Advisory
- https://sourceware.org/pipermail/libc-alpha/2020-September/117779.htmlPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-29573?
How severe is CVE-2020-29573?
How do I fix CVE-2020-29573?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-29567An issue was discovered in Xen 4.14.x. When moving IRQs betw…6.2
- CVE-2020-29568An issue was discovered in Xen through 4.14.x. Some OSes (su…6.5
- CVE-2020-29569An issue was discovered in the Linux kernel through 5.10.1, …8.8
- CVE-2020-29570An issue was discovered in Xen through 4.14.x. Recording of …6.2
- CVE-2020-29571An issue was discovered in Xen through 4.14.x. A bounds chec…6.2
- CVE-2020-29572app/View/Elements/genericElements/SingleViews/Fields/generic…6.1
- CVE-2020-29574An SQL injection vulnerability in the WebAdmin of Cyberoam O…9.8
- CVE-2020-29575The official elixir Docker images before 1.8.0-alpine (Alpin…9.8
- CVE-2020-29576The official eggdrop Docker images before 1.8.4rc2 contain a…9.8
- CVE-2020-29577The official znc docker images before 1.7.1-slim contain a b…9.8
- CVE-2020-29578The official piwik Docker images before fpm-alpine (Alpine s…9.8
- CVE-2020-29579The official Express Gateway Docker images before 1.14.0 con…9.8
Are you affected by CVE-2020-29573?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST