glibc 2.37: out-of-bounds write in sprintf when formatting a padded, thousands-separated number

Impact

In glibc 2.37, sprintf can write past the end of a destination buffer that was sized correctly for the output, when the format asks for a padded, thousands-separated representation of a number - the report gives 1,234,567 padded to 13 overflowing by two bytes. Any correctly written program on the host can therefore be made to corrupt adjacent memory, so the blast radius is whichever locale-aware service formats attacker-influenced numeric values. This matters on a GPU node because glibc underlies everything on it - container runtimes, the kubelet, telemetry agents, job schedulers - and the application code is not at fault, so no amount of auditing your own services removes the bug. Only glibc 2.37 is named in the report; fleets on older or newer glibc are not exposed.

Who can reach it

Local or remote, depending entirely on the calling program: an attacker needs to influence the numeric value and format width passed to sprintf by some process on the host, with a locale that uses a thousands separator. glibc itself exposes no listener.

What to do

Patch glibc past 2.37 or apply the distribution backport of the sourceware fix (bug 30068). As with any glibc update, every process linked against the library has to be restarted to pick it up, which in practice means draining the node and rebooting it. First check whether any host in the fleet actually runs 2.37 - the window of affected releases is narrow and most long-term distributions skipped it.

References

Related entries

• OpenSSH before 9.3: ssh-add loads smartcard keys into ssh-agent without the requested destination constraintsCVE-2023-28531 · OpenSSH ssh-add (smartcard key destination constraints)Critical
• VMware vCenter: Out-of-bounds write in the DCERPC implementation - unauthenticated remote code executionCVE-2023-34048 · VMware vCenterCritical
• OpenSSH (ssh-agent): Remote code execution in ssh-agent PKCS#11 support when agent forwarding reaches a hostile hostCVE-2023-38408 · OpenSSH (ssh-agent)Critical
• Linux kernel NVMe target core (nvmet_req_complete submission-queue dereference): Nvmet_req_complete() dereferenced reqCVE-2023-53116 · Linux kernel NVMe target core (nvmet_req_complete submission-queue dereference)Critical
• Linux kernel (net/smc): When an incoming connection tries SMC-Rv2 and device setup fails, the listener does not resetCVE-2023-53382 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): On the server side of the SMC-R LLC handshake, adding a second link to a link group runsCVE-2023-54237 · Linux kernel (net/smc)Critical