The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.
{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc-bin",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc-devtools",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-dev-s390",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-prof",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-s390",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "locales",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "locales-all",
"binary_version": "2.35-0ubuntu3.18"
},
{
"binary_name": "nscd",
"binary_version": "2.35-0ubuntu3.18"
}
]
}{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc-bin",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc-devtools",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-dev-s390",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-s390",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "locales",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "locales-all",
"binary_version": "2.39-0ubuntu8.12"
},
{
"binary_name": "nscd",
"binary_version": "2.39-0ubuntu8.12"
}
]
}{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc-bin",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc-devtools",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc-gconv-modules-extra",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "locales",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "locales-all",
"binary_version": "2.43-2ubuntu2.7"
},
{
"binary_name": "nscd",
"binary_version": "2.43-2ubuntu2.7"
}
]
}{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc-bin",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc-devtools",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc-gconv-modules-extra",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "locales",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "locales-all",
"binary_version": "2.44-1ubuntu2.1"
},
{
"binary_name": "nscd",
"binary_version": "2.44-1ubuntu2.1"
}
]
}{
"binaries": [
{
"binary_name": "eglibc-source",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc-bin",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-armel",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-dev-armel",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-pic",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-prof",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "multiarch-support",
"binary_version": "2.19-0ubuntu6.15+esm4"
},
{
"binary_name": "nscd",
"binary_version": "2.19-0ubuntu6.15+esm4"
}
]
}{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc-bin",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-armel",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-dev-armel",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-dev-s390",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-pic",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-s390",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "locales",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "locales-all",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "multiarch-support",
"binary_version": "2.23-0ubuntu11.3+esm9"
},
{
"binary_name": "nscd",
"binary_version": "2.23-0ubuntu11.3+esm9"
}
]
}{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc-bin",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-armel",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-dev-armel",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-dev-s390",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-lse",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-pic",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-s390",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "locales",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "locales-all",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "multiarch-support",
"binary_version": "2.27-3ubuntu1.6+esm6"
},
{
"binary_name": "nscd",
"binary_version": "2.27-3ubuntu1.6+esm6"
}
]
}{
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc-bin",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-armel",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-dev-armel",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-dev-s390",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-lse",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-pic",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-prof",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-s390",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "locales",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "locales-all",
"binary_version": "2.31-0ubuntu9.18+esm1"
},
{
"binary_name": "nscd",
"binary_version": "2.31-0ubuntu9.18+esm1"
}
]
}