Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 677272 (CVE-2019-7309) - <sys-libs/glibc-2.30-r6 : x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309)
Summary: <sys-libs/glibc-2.30-r6 : x32 memcmp can treat positive length as 0 (if sign ...
Alias: CVE-2019-7309
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: x86 Linux
: Low minor (vote)
Assignee: Gentoo Security
Whiteboard: A4 [glsa+ cve]
Depends on: glibc-2.30-stable
  Show dependency tree
Reported: 2019-02-04 18:56 UTC by D'juan McDonald (domhnall)
Modified: 2020-06-13 01:04 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description D'juan McDonald (domhnall) 2019-02-04 18:56:38 UTC

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

@maintainter(s): master branch for 2.27 was updated [ Mon Feb 4 08:55:52 2019 ],
via 2ebadb6451eda1d518d70e26cf4ceeb0362e2456. 

Gentoo Security Padawan
Comment 1 Andreas K. Hüttel gentoo-dev 2020-03-23 21:31:48 UTC
Fixed in 2.30
Comment 2 NATTkA bot gentoo-dev 2020-04-12 19:30:13 UTC
Unable to check for sanity:

> dependent bug #712726 is missing keywords
Comment 3 NATTkA bot gentoo-dev 2020-04-13 14:41:16 UTC
Resetting sanity check; package list is empty or all packages are done.
Comment 4 Larry the Git Cow gentoo-dev 2020-05-04 18:37:38 UTC
The bug has been referenced in the following commit(s):

commit cce133930b2d85cd8bed66715857ccf550048bbd
Author:     Andreas K. Hüttel <>
AuthorDate: 2020-05-04 18:35:42 +0000
Commit:     Andreas K. Hüttel <>
CommitDate: 2020-05-04 18:37:12 +0000

    package.mask: Update old glibc mask, now masking <2.30-r8
    Signed-off-by: Andreas K. Hüttel <>

 profiles/package.mask | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 5 Yury German Gentoo Infrastructure gentoo-dev 2020-05-22 00:41:19 UTC
Removed from tree, adding to GLSA
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2020-06-13 01:04:50 UTC
This issue was resolved and addressed in
 GLSA 202006-04 at
by GLSA coordinator Aaron Bauman (b-man).