[PATCH 2/2] Add advisory text for CVE-2025-0395

[Adhemerval Zanella Netto]

On 22/01/25 10:27, Siddhesh Poyarekar wrote:
> On 2025-01-22 08:15, Adhemerval Zanella Netto wrote:
>>>   advisories/GLIBC-SA-2025-0001 | 23 +++++++++++++++++++++++
>>>   1 file changed, 23 insertions(+)
>>>   create mode 100644 advisories/GLIBC-SA-2025-0001
>>>
>>> diff --git a/advisories/GLIBC-SA-2025-0001 b/advisories/GLIBC-SA-2025-0001
>>> new file mode 100644
>>> index 0000000000..4624c06469
>>> --- /dev/null
>>> +++ b/advisories/GLIBC-SA-2025-0001
>>> @@ -0,0 +1,23 @@
>>> +assert: Buffer overflow when printing assertion failure message
>>> +
>>> +When the assert() function fails, it does not allocate enough space for the
>>> +assertion failure message string and size information, which may lead to a
>>> +buffer overflow if the message string size aligns to page size.
>>
>> Would be worth to add this is a feature added by glibc for post-mortem analysis
>> (to get the abort/assert message in the core file)?
> 
> Thanks, I've folded it into the subsequent paragraph like so:
> 
>>> +
>>> +This bug can be triggered when an assertion in a program fails.  The assertion
>>> +failure message typically includes, in addition to the invariant assertion
>>> +string and function name, the name of the program.  If the name of the failing
>>> +program is user controlled, for example on a local system, this could allow an
>>> +attacker to control the assertion failure to trigger this buffer overflow.
> 
> The assertion failure message is allocated to allow developers to see this failure in core dumps and it typically includes, in addition to the invariant assertion string and function name, the name of the program.

Sounds good, thanks.

> 
> Sid