Incomplete Internal State Distinction Affecting glibc package, versions [2.40-12.fc41,2.40.9000-21.fc42)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-GLIBC-8502190
- published13 Dec 2024
- disclosed12 Dec 2024
- creditUnknown
Introduced: 12 Dec 2024
NewCVE-2024-12455 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade glibc to version 2.40.9000-21.fc42 or higher.
Overview
Affected versions of this package are vulnerable to Incomplete Internal State Distinction due to an implementation error in the getrandom function and the signaling method for return codes on the ppc64le platform. An attacker can cause data corruption or a Denial-of-Service by exploiting the out-of-bounds write which occurs unpredictably.