CVE-2020-29573 json
sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input…
published 5y ago modified 26d ago also EUVD-2020-21935
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.
Patch / fix
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- glibc Debian 14, Debian 13, Debian 12 2.23-1
debian advisories DEBIAN-CVE-2020-29573
- glibc RHEL 7 2.17-322.el7_9
- nscd RHEL 7 2.17-322.el7_9
- glibc-utils RHEL 7 2.17-322.el7_9
- glibc-common RHEL 7 2.17-322.el7_9
- glibc-debuginfo-common RHEL 7 2.17-322.el7_9
- glibc RHEL 7.6 TUS, RHEL 7.6 E4S, RHEL 7.6 AUS 2.17-260.el7_6.9
- nscd RHEL 7.6 TUS, RHEL 7.6 E4S, RHEL 7.6 AUS 2.17-260.el7_6.9
- glibc-utils RHEL 7.6 TUS, RHEL 7.6 E4S, RHEL 7.6 AUS 2.17-260.el7_6.9
red hat advisories RHSA-2021:3315RHSA-2021:2998RHSA-2021:2813RHSA-2021:0348
- glibc SLES 12 SP3-BCL, SLES 12 SP2-BCL 2.22-126.1
- glibc SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 2.22-114.8.3
- glibc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 2.26-13.56.1
- glibc SLES 11 SP4 LTSS EXTREME CORE 2.11.3-17.110.43.1
suse advisories SUSE-SU-2024:0759-1SUSE-SU-2022:2886-1SUSE-SU-2021:1165-1SUSE-SU-2021:0653-1
- glibc openSUSE Tumbleweed 2.34-1.2
- glibc openSUSE Leap 15.2 2.26-lp152.26.6.1
- glibc-testsuite-src openSUSE Leap 15.2 2.26-lp152.26.6.1
opensuse advisories openSUSE-SU-2024:10792-1openSUSE-SU-2021:0358-1
Is CVE-2020-29573 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-29573 updated cvss 7.5
glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern
-
Red Hat Enterprise Linux 5 glibc Red Hat Enterprise Linux 6 nscd, glibc, glibc-utils, glibc-commonaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Do 1 openshiftdo/odo-init-image-rhel7 1.1.3-2fixed: vendor fix RHSA-2021:0949
-
Red Hat Enterprise Linux Client (v. 7) nscd 2.17-322.el7_9, glibc 2.17-322.el7_9, glibc-utils 2.17-322.el7_9, glibc-common 2.17-322.el7_9, glibc-debuginfo-common 2.17-322.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9fixed: vendor fix RHSA-2021:0348
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) nscd 2.17-292.el7_7.2, glibc 2.17-292.el7_7.2, glibc-utils 2.17-292.el7_7.2, glibc-common 2.17-292.el7_7.2, glibc-debuginfo-common 2.17-292.el7_7.2fixed: vendor fix RHSA-2021:2998
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9fixed: vendor fix RHSA-2021:0348
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) glibc-debuginfo-common 2.17-292.el7_7.2fixed: vendor fix RHSA-2021:2998
-
Red Hat Enterprise Linux Server (v. 7) nscd 2.17-322.el7_9, glibc 2.17-322.el7_9, glibc-utils 2.17-322.el7_9, glibc-common 2.17-322.el7_9, glibc-debuginfo-common 2.17-322.el7_9fixed: vendor fix RHSA-2021:0348
-
Red Hat Enterprise Linux Server AUS (v. 7.4) nscd 2.17-196.el7_4.4, glibc 2.17-196.el7_4.4, glibc-utils 2.17-196.el7_4.4, glibc-common 2.17-196.el7_4.4, glibc-debuginfo-common 2.17-196.el7_4.4fixed: vendor fix RHSA-2021:2813
show 16 moreshow fewer
-
Red Hat Enterprise Linux Server AUS (v. 7.6) nscd 2.17-260.el7_6.9, glibc 2.17-260.el7_6.9, glibc-utils 2.17-260.el7_6.9, glibc-common 2.17-260.el7_6.9, glibc-debuginfo-common 2.17-260.el7_6.9fixed: vendor fix RHSA-2021:3315
-
Red Hat Enterprise Linux Server E4S (v. 7.4) nscd 2.17-196.el7_4.4, glibc 2.17-196.el7_4.4, glibc-utils 2.17-196.el7_4.4, glibc-common 2.17-196.el7_4.4, glibc-debuginfo-common 2.17-196.el7_4.4fixed: vendor fix RHSA-2021:2813
-
Red Hat Enterprise Linux Server E4S (v. 7.6) nscd 2.17-260.el7_6.9, glibc 2.17-260.el7_6.9, glibc-utils 2.17-260.el7_6.9, glibc-common 2.17-260.el7_6.9, glibc-debuginfo-common 2.17-260.el7_6.9fixed: vendor fix RHSA-2021:3315
-
Red Hat Enterprise Linux Server EUS (v. 7.7) nscd 2.17-292.el7_7.2, glibc 2.17-292.el7_7.2, glibc-utils 2.17-292.el7_7.2, glibc-common 2.17-292.el7_7.2, glibc-debuginfo-common 2.17-292.el7_7.2fixed: vendor fix RHSA-2021:2998
-
Red Hat Enterprise Linux Server Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9fixed: vendor fix RHSA-2021:0348
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) glibc-debuginfo-common 2.17-196.el7_4.4fixed: vendor fix RHSA-2021:2813
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.6) glibc-debuginfo-common 2.17-260.el7_6.9fixed: vendor fix RHSA-2021:3315
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.4) glibc-debuginfo-common 2.17-196.el7_4.4fixed: vendor fix RHSA-2021:2813
-
Red Hat Enterprise Linux Server Optional E4S (v. 7.6) glibc-debuginfo-common 2.17-260.el7_6.9fixed: vendor fix RHSA-2021:3315
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) glibc-debuginfo-common 2.17-292.el7_7.2fixed: vendor fix RHSA-2021:2998
-
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) glibc-debuginfo-common 2.17-196.el7_4.4fixed: vendor fix RHSA-2021:2813
-
Red Hat Enterprise Linux Server Optional TUS (v. 7.6) glibc-debuginfo-common 2.17-260.el7_6.9fixed: vendor fix RHSA-2021:3315
-
Red Hat Enterprise Linux Server TUS (v. 7.4) nscd 2.17-196.el7_4.4, glibc 2.17-196.el7_4.4, glibc-utils 2.17-196.el7_4.4, glibc-common 2.17-196.el7_4.4, glibc-debuginfo-common 2.17-196.el7_4.4fixed: vendor fix RHSA-2021:2813
-
Red Hat Enterprise Linux Server TUS (v. 7.6) nscd 2.17-260.el7_6.9, glibc 2.17-260.el7_6.9, glibc-utils 2.17-260.el7_6.9, glibc-common 2.17-260.el7_6.9, glibc-debuginfo-common 2.17-260.el7_6.9fixed: vendor fix RHSA-2021:3315
-
Red Hat Enterprise Linux Workstation (v. 7) nscd 2.17-322.el7_9, glibc 2.17-322.el7_9, glibc-utils 2.17-322.el7_9, glibc-common 2.17-322.el7_9, glibc-debuginfo-common 2.17-322.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9fixed: vendor fix RHSA-2021:0348
-
Red Hat Enterprise Linux 8 nscd, glibc, libnsl, nss_db, nss_hesiod, glibc-utils, +7 more Red Hat Enterprise Linux 9 nscd, glibc, libnsl, nss_db, nss_hesiod, glibc-utils, +6 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 7.5
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
sourceware.org
/bugzilla/show_bug.cgi?id=26649
issue-tracking, patch, third-party-advisory
-
sourceware.org
/pipermail/libc-alpha/2020-September/117779.html
patch, third-party-advisory
-
security.gentoo.org
/glsa/202101-20
vendor-advisory, third-party-advisory
-
security.netapp.com
/advisory/ntap-20210122-0004/
third-party-advisory
- cert-portal.siemens.com /productcert/html/ssa-398330.html
Sources
- CVE List CVE-2020-29573
- NVD CVE-2020-29573
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.