glibc through 2.29: heap buffer over-read in regexec during case-insensitive regex matching

Impact

proceed_next_node in glibc's regexec reads past the end of a heap buffer on an attempted case-insensitive regular-expression match, in all versions through 2.29. Any service on the host that compiles or matches an attacker-influenced pattern with the system regex functions can be made to over-read, which in practice means a crash or small adjacent-memory disclosure in that process rather than code execution; nothing in the record shows a write. On a GPU fleet the plausible callers are log processors, access-control rules and admission or policy tooling that accept patterns from users. Only very old glibc is affected - a current host is not exposed, which makes this useful mainly as an audit item for long-lived management appliances and vendor-embedded Linux images.

Who can reach it

Requires a process on the host that passes an attacker-influenced pattern or subject into regexec with case-insensitive matching, on glibc 2.29 or older. Whether authentication is needed depends on that process.

What to do

Move to glibc 2.30 or later, or apply the distribution backport (Gentoo GLSA 202006-04; the glibc bug reports are 34140 and 34142). Any glibc replacement requires restarting every linked process, so expect a drain and reboot per node. For appliances and embedded images that cannot be upgraded independently, the vendor update is the only route.

References

Related entries

• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• glibc 2.32/2.33: use-after-free in mq_notify of the caller's notification thread attributesCVE-2021-33574 · glibc mq_notify (POSIX message queue notification thread attributes)Critical
• OpenSSL: SM2 decryption understates the required buffer, overflowing it by up to 62 bytesCVE-2021-3711 · OpenSSL EVP_PKEY_decrypt (SM2 plaintext buffer size calculation)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical