CVE-2014-6040

Vulnerability

GNU C Library (glibc) versions before 2.20 contain an out-of-bounds read vulnerability in the iconv function when converting encoded data from IBM code pages IBM933, IBM935, IBM937, IBM939, or IBM1364 to UTF-8. The flaw is triggered by supplying a multibyte character value of 0xffff as input, which causes an invalid memory read and results in a denial of service via application crash. The bug affects all glibc releases prior to the fix included in version 2.20, and was also addressed in downstream distributions such as Oracle Linux 6 (glibc-2.12-1.149.2) and Ubuntu 12.04 LTS [1][3][4].

Exploitation

An attacker can trigger the crash by delivering crafted multibyte data containing a 0xffff character value to any application that calls iconv with one of the affected IBM code page converters. No special privileges are required beyond the ability to supply input to such an application (e.g., via network service, file upload, or user interaction). The exploitation is straightforward: the malicious input is processed during the conversion routine, leading to an out-of-bounds read and a segmentation fault, as confirmed by the bug report and upstream fix [2][3][4].

Impact

Successful exploitation causes a denial of service by crashing the calling application. The impact is limited to availability; there is no evidence of information disclosure or code execution. Attackers can repeatedly send malicious input to cause persistent service disruption. The severity is considered moderate in downstream advisories [1][3].

Mitigation

All glibc versions from 2.16 to 2.20 are vulnerable. The fix was committed upstream for glibc 2.20 (referenced in the bug tracker as bug 17325). Oracle Linux released an updated package (glibc-2.12-1.149.2) in ELSA-2015-0016 on 2015-01-07 [1]. Ubuntu published USN-2432-1 on 2014-12-03 providing fixed packages for Ubuntu 12.04 LTS [3]. Users should upgrade to the latest glibc from their distribution vendor. No workaround is available other than applying the patch or update; there is no known KEV listing for this CVE.