Bug 2258948 (CVE-2024-0684) - CVE-2024-0684 coreutils: heap overflow in split --line-bytes with very long lines
Summary: CVE-2024-0684 coreutils: heap overflow in split --line-bytes with very long l...
Status: NEW
Alias: CVE-2024-0684
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Product Security
QA Contact:
Depends On: 2258913
Blocks: 2258947
TreeView+ depends on / blocked
Reported: 2024-01-18 07:15 UTC by Rohit Keshri
Modified: 2024-01-19 12:14 UTC (History)
2 users (show)

Fixed In Version: coreutils 9.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description Rohit Keshri 2024-01-18 07:15:46 UTC
Since coreutils 9.2 https://github.com/coreutils/coreutils/commit/40bf1591b
introduced a heap overflow issue, which can be triggered like:

    { printf '%131070s\n' ''; printf 'x\n'; printf '%131071s\n' ''; } > in
    split -C 131072 ---io=131072 in

That will dump core, but as with all heap overflows is a potential security issue.
I'll leave it up to you to determine whether a CVE is required.

There is already a patch upstream, but it's not flagged as a security issue,
in an abundance of caution, in case this issue in more security sensitive than first envisaged. The upstream patch is:

Comment 1 Rohit Keshri 2024-01-18 07:20:12 UTC

Comment 3 Mauro Matteo Cascella 2024-01-18 13:59:39 UTC
Created coreutils tracking bugs for this issue:

Affects: fedora-all [bug 2258913]

Note You need to log in before you can comment on or make changes to this bug.