There’s a fun buffer overflow problem in the Glibc __vsyslog_internal() function. This one’s a real rollercoaster, because logging vulnerabilities are always scary, but at a first look, it seems nearly impossible to exploit. The vulnerability relies on a very long program name, which can overflow an internal buffer. No binaries are going to have a name longer than 1024 bytes, so there’s no problem, right?
This is a companion discussion topic for the original entry at https://hackaday.com/2024/02/02/this-week-in-security-glibc-ivanti-jenkins-and-runc/