A vulnerability (CVE-2024-2961) has been identified in the standard C library Musl, leading to a buffer overflow when converting specially formatted text from EUC-KR encoding to UTF-8 using the iconv() function. The vulnerability manifests starting from version musl 0.9.13 and will be fixed in the upcoming release 1.2.6 (a patch should be used until the update is published). The vulnerability was discovered by the libxml2 library during fuzz testing.
This vulnerability can be exploited to attack applications built with the Musl library that perform text conversion from external sources. Exploiting the vulnerability is possible when calling the iconv_open() function in the application with the source encoding set to EUC-KR and the target encoding to UTF-8. Examples of potentially vulnerable applications include programs that recode XML, HTML, and email messages based on the encoding specified in the MIME type header (e.g., 'text/plain; charset=EUC-KR'). For instance, such conversions are carried out by programs that use the libxml2 library.
The vulnerability is caused by a combination of two errors. The first error relates to a lack of proper checking for invalid multibyte sequences in the EUC-KR decoder. The second error exists in the UTF-8 encoder, which was not designed to handle the fact that the input data decoder may return invalid Unicode scalar values. As a result, processing sequences like '\xc8\x41' leads to writing values outside the allocated buffer.
Source: opennet.ru
