Listen to this Post
The vulnerability is a memory corruption flaw in the `iconv` function of musl libc, specifically when converting text from the EUC-KR character encoding to UTF-8. It stems from two interrelated bugs. First, the EUC-KR input decoder performs incorrect validation on attacker-controlled byte sequences. This allows specially crafted input to produce invalid wide character codes that are not valid Unicode Scalar Values. Second, the UTF-8 output encoder (wctomb_utf8) lacks proper error handling for these invalid inputs. When the decoder passes a malformed character, `wctomb_utf8` returns an error value of (size_t)-1. The subsequent logic in the `iconv` function fails to check for this error and incorrectly adjusts the output buffer pointer and byte count. This arithmetic overflow leads to an out-of-bounds write, corrupting memory adjacent to the intended output buffer.
Platform: musl libc
Version: 0.9.13-1.2.5
Vulnerability: Out-of-bounds write
Severity: HIGH
date: 2025-02-13
Prediction: Expected 2025-02-13
What Undercode Say:
Bash Commands for Vulnerability Scanning:
– `brew install aquasecurity/trivy/trivy`
– `docker pull unleashorg/unleash-server:6.9.0`
– `trivy image unleashorg/unleash-server:6.9.0`
How Exploit:
An attacker must control input that is processed as EUC-KR and converted to UTF-8 via iconv. By submitting crafted EUC-KR byte sequences, they trigger the flawed decoder. The resulting invalid character codes cause an unchecked buffer pointer overflow during UTF-8 encoding, leading to arbitrary memory corruption. This scenario is common in applications that use declared charset metadata from untrusted sources, such as XML, HTML, or email, to perform charset conversion.
Protection from this CVE
- Update musl libc to version 1.2.6 or later, which contains the fix.
- Apply the source patches referenced in the security advisory.
- For static binaries, a workaround is to patch the binary to disable EUC-KR support by altering the charset name string.
- Ensure systems using Alpine Linux or other musl-based distributions receive updated packages.
Impact
- Memory Corruption: Successful exploitation leads to out-of-bounds memory writes.
- Arbitrary Code Execution: Memory corruption can potentially allow remote code execution, especially in network-facing services.
- System Compromise: Impacts confidentiality, integrity, and availability, with CVSS scores as high as 8.1-9.2.
- Widespread Reach: Affects all versions from 0.9.13 to 1.2.5, impacting many Linux distributions and container images (e.g., Alpine).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
