Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

The vulnerability exists in the tdelete function of the GNU C Library versions 2.1 to 2.44. The function maintains an explicit stack of parent nodes for rebalancing a binary tree, which grows dynamically as the tree is traversed. Two rebalancing branches push an additional entry onto this stack without checking if there is capacity, causing a write one pointer beyond the end of the alloca-allocated stack array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 or 40 plus multiples of 20, implying a tree with at least one million nodes. The overflowed value is a pointer into a tree node and is not attacker-controlled. No common applications have been identified as vulnerable. Red Hat has issued updated RPM packages for glibc and related components in their hardened images to fix this issue.

The vulnerability may cause an application crash due to a stack buffer overflow when tdelete is called on a sufficiently deep tree. The overflow writes one pointer past the allocated stack array, but the value written is not attacker-controlled. Exploitation requires a very large tree structure, making practical exploitation difficult. No known exploits or affected applications in common distributions have been reported.

Red Hat has released updated RPM packages for glibc and related components in their hardened images to address this vulnerability. Applying these official updates will remediate the issue. There are no indications that additional mitigation steps are required beyond applying the vendor-provided security update.