Use after free in GNU glibc
Priority LOW 32CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
Why it matters now
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 3 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GNU | glibc | Affected: versions 2.14 and later; Fixed: version 2.32 | — | No fix listed | CNA |
- glibc VendorGNU Affected Affected: versions 2.14 and later; Fixed: version 2.32 Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | before 2.32.0 | Vulnerable | GNU |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* Versions before 2.32.0 Vulnerable ·GNU
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
Red Hat 1 advisory
- RHSA-2020:4444 Released 2020-11-04 · Red Hat rating Moderateglibc security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 8) glibc-benchtests-2.28-127.el8, glibc-nss-devel-2.28-127.el8, glibc-static-2.28-127.el8 +1
- Red Hat Enterprise Linux AppStream (v. 8) compat-libpthread-nonshared-2.28-127.el8, glibc-utils-2.28-127.el8
- Red Hat Enterprise Linux BaseOS (v. 8) glibc-2.28-127.el8, glibc-all-langpacks-2.28-127.el8, glibc-common-2.28-127.el8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2020:4444 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4444 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:4444 |
Not affected: 2 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1752
- 2026-10-03 Alias added: GHSA-8x3m-4qgh-829r
References
Patch 2
Advisory 4
Other 3
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ddc650e9b3dc916eab417ce9f79e67337b05035c
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
More GNU Glibc vulnerabilities
- TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
- TI-2015-00205 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… CVSS 2.0HIGH 10.0
- TI-2026-04772 scanf %mc off-by-one heap buffer overflow CVSS 3.1CRITICAL 9.8
- TI-2022-07360 The deprecated compatibility function clnt_create in the sunrpc module of the GNU C… CVSS 3.1CRITICAL 9.8
- TI-2022-07359 The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C… CVSS 3.1CRITICAL 9.8
- TI-2015-06274 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the… CVSS 3.0HIGH 8.1
Sources
- CVE-2020-1752 · CVE Program
- CVE-2020-1752 · NVD
- FIRST EPSS
- GHSA-8x3m-4qgh-829r · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1752 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences