A vulnerability has been discovered in the split utility, included in the GNU coreutils package and used for splitting large files into parts (CVE-2024-0684). This vulnerability results in a buffer overflow when handling long lines (several hundred bytes) when using the '—line-bytes' ('-C') option. The issue was identified during an analysis of crashes occurring when using the split utility to separate data transmitted via QR codes.
The vulnerability is caused by a mistake made in the coreutils 7.2 release when replacing the xrealloc function call with xpalloc. A patch has already been accepted into the codebase, but a new version with the fix has not yet been released. To demonstrate the vulnerability, an example file has been published that triggers a buffer overflow when running 'split -C 1024 ./split_me'.
Source: opennet.ru
