A split utility included in the GNU coreutils package, used for splitting large files into parts, has a vulnerability (CVE-2024-0684) that leads to a buffer overflow when handling long lines (several hundred bytes) when the '—line-bytes' ('-C') option is used. The vulnerability was discovered during the analysis of failures occurring while using the split utility to divide data transmitted via QR codes.
The vulnerability is caused by an error made in the coreutils 7.2 release when replacing the xrealloc function call with xpalloc. A patch with the fix has already been accepted into the codebase, but a new version with the fix has not yet been created. A sample file that triggers the overflow when running 'split -C 1024 ./split_me' has been published to demonstrate the vulnerability.
Forrás: opennet.ru
