CVE-2018-6758
Description
The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
Root cause
"Missing bounds check on dir_len before memcpy into a fixed-size stack buffer allows stack-based buffer overflow."
Attack vector
An attacker can supply an overly long directory path (with `dir_len` greater than `PATH_MAX`) to a uWSGI endpoint that calls `uwsgi_expand_path`. The unchecked `memcpy` overflows the stack buffer `src`, potentially corrupting adjacent memory. This can be triggered remotely if the application exposes a path-handling interface that passes attacker-controlled input to the vulnerable function. [patch_id=6629717]
Affected code
The vulnerability is in the `uwsgi_expand_path` function in `core/utils.c`. The function copies a caller-supplied directory length (`dir_len`) into a fixed-size stack buffer `src[PATH_MAX+1]` via `memcpy` without checking whether `dir_len` exceeds `PATH_MAX`, leading to a stack-based buffer overflow.
What the fix does
The patch adds an early check: if `dir_len > PATH_MAX`, the function logs an error and returns NULL, preventing the overflow. It also replaces the fixed-size stack buffer `src[PATH_MAX+1]` with a heap-allocated string via `uwsgi_concat2n`, and frees that allocation in both the error and success paths. This eliminates the stack corruption and ensures the path length is always validated before use. [patch_id=6629717]
Preconditions
- inputThe attacker must be able to supply a directory path whose length exceeds PATH_MAX to a uWSGI endpoint that invokes uwsgi_expand_path.
- networkThe vulnerable function must be reachable from an external interface (e.g., a web request handler).
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- lists.unbit.it/pipermail/uwsgi/2018-February/008835.htmlmitrex_refsource_MISC
- github.com/unbit/uwsgi/commit/cb4636f7c0af2e97a4eef7a3cdcbd85a71247bfemitrex_refsource_MISC
- lists.debian.org/debian-lts-announce/2018/02/msg00010.htmlmitremailing-listx_refsource_MLIST
News mentions
0No linked articles in our index yet.