News for hackers. Stuff that matters.

A comment on Date bug in Rust-based coreutils affects Ubuntu 25.10 automatic updates. Parent comment

Re:Date bug in Rust-based coreutils affects Ubuntu 25.10 aut... by xxs on Friday October 24, 2025 @03:09AM (#45691758)
In some cases it was possible to crash (overflow) sort.c, not just DoS. I did try to look more info the issue - it was not handled for quite some time however I did not find any real world impact.
[ Parent | on HN ]
Re:Date bug in Rust-based coreutils affects Ubuntu 25.10 aut... by collinfunk on Friday October 24, 2025 @03:49AM (#45692006)
Minor correction, but that bug was never in any "official" coreutils release. The bug was in a multi-byte character patch that many distributions use (and still use). There have been other CVEs in that patch [1].

But the worst you can do is crash 'sort' with that. Note that uutils also has crashes. Here is one due to unbounded recursion:

  $ ./target/release/coreutils mkdir -p `python3 -c 'print("./" + "a/" * 32768)'`
  Segmentation fault (core dumped)
Not saying that both issues don't deserve fixing. But I wouldn't really panic over either of them.

[1] https://lwn.net/Articles/535735/

[ Parent | on HN ]