Описание
GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
A flaw was found in GNU libidn. This vulnerability allows an attacker to cause out-of-bounds reads of uninitialized memory within the ToUnicode APIs due to mishandling in the idna_to_unicode_internal function. This could lead to information disclosure or a denial of service.
Отчет
This flaw resides in GNU libidn's idna_to_unicode_internal() function, used by the idna_to_unicode_* API family. The function assumes its internal ToASCII comparison buffer always begins with the "xn--" ACE prefix. When a decoded label is pure ASCII and shorter than four characters, no prefix is added, and the round-trip verification instead reads past the buffer's null terminator into uninitialized stack memory. Under certain call sequences that leave matching residual data on the stack, this allows an ACE-encoded label that should fail validation to be silently accepted and normalized to a different, shorter string, which could affect domain-based security decisions (allow/deny-list matching, hostname comparisons, routing, logging) made by applications relying on the result. This flaw does not affect libidn2. Its round-trip verification in lookup.c never assumes the "xn--" prefix is present on caller-supplied data; every prefix-relative offset is either guarded by an explicit prefix check beforehand or applied to a buffer the function itself just wrote the prefix into, and it compares the full label rather than a bare suffix.
Меры по смягчению последствий
No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Migration Toolkit for Containers | libidn | Fix deferred | ||
| Red Hat Enterprise Linux 10 | libidn2 | Not affected | ||
| Red Hat Enterprise Linux 6 | libidn | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libidn | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libidn | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libidn2 | Not affected | ||
| Red Hat Enterprise Linux 9 | libidn2 | Not affected | ||
| Red Hat Hardened Images | libidn2-main-2.3.8-4.hum1 | Fixed | RHSA-2026:42125 | 20.07.2026 |
Показывать по
Дополнительная информация
Статус:
2.9 Low
CVSS3
Связанные уязвимости
GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
GNU libidn before 1.44 is prone to out-of-bounds reads ofuninitialized ...
GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
2.9 Low
CVSS3