Bug 822015 (CVE-2021-43396)

Summary:	sys-libs/glibc: remote corruption of iconv() output (CVE-2021-43396)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	minor	CC:	toolchain
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://sourceware.org/bugzilla/show_bug.cgi?id=28524
Whiteboard:	A4 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-11-05 21:26:01 UTC

CVE-2021-43396:

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases.

Appears to be unreleased.

Comment 1 Sam James archtester

2021-11-05 21:33:33 UTC

2.34 backport at https://sourceware.org/git/?p=glibc.git;a=commit;h=f411207a833d0c49578ebe7062aee3660813ed5f

Doesn't seme to have been backported to 2.33 so I suppose not applicable.

Note that we probably want the latest 2.34 patches in that branch anyway.

Comment 2 Sam James archtester

2022-04-12 10:01:26 UTC

https://sourceware.org/bugzilla/show_bug.cgi?id=28524#c6