The attacker can exploit this vulnerability to leak uninitialized stack data byte by byte, potentially exposing memory locations of critical data.It uses a buffer (sum2) on the stack to store part of the checksum but does not initialize this buffer. An attacker can manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory. This allows an attacker to leak one byte of uninitialized stack data at a time. Over multiple requests, the attacker can leak up to MAX_DIGEST_LEN - 8 bytes of sensitive data, which could help defeat Address Space Layout Randomization (ASLR).
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:0325 https://access.redhat.com/errata/RHSA-2025:0325
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:0324 https://access.redhat.com/errata/RHSA-2025:0324
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:0637 https://access.redhat.com/errata/RHSA-2025:0637
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:0688 https://access.redhat.com/errata/RHSA-2025:0688
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2025:0714 https://access.redhat.com/errata/RHSA-2025:0714
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2025:0774 https://access.redhat.com/errata/RHSA-2025:0774
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2025:0787 https://access.redhat.com/errata/RHSA-2025:0787
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:0790 https://access.redhat.com/errata/RHSA-2025:0790
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Via RHSA-2025:0849 https://access.redhat.com/errata/RHSA-2025:0849
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:0884 https://access.redhat.com/errata/RHSA-2025:0884
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2025:0885 https://access.redhat.com/errata/RHSA-2025:0885
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:1120 https://access.redhat.com/errata/RHSA-2025:1120
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:1123 https://access.redhat.com/errata/RHSA-2025:1123
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:1128 https://access.redhat.com/errata/RHSA-2025:1128
This issue has been addressed in the following products: RHOL-5.9-RHEL-9 Via RHSA-2025:1227 https://access.redhat.com/errata/RHSA-2025:1227
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2025:1242 https://access.redhat.com/errata/RHSA-2025:1242
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:1451 https://access.redhat.com/errata/RHSA-2025:1451
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2025:2701 https://access.redhat.com/errata/RHSA-2025:2701