CVE-2024-0684: GNU Coreutils Split DoS Vulnerability

CVE-2024-0684 Overview

A heap overflow vulnerability has been discovered in the GNU coreutils split program. The flaw exists within the line_bytes_split() function, where user-controlled data of multiple hundred bytes in length can trigger a heap overflow condition. This vulnerability can potentially lead to an application crash and denial of service on affected systems.

Critical Impact

Local attackers with low privileges can exploit this heap overflow to crash the split utility, causing denial of service on systems running vulnerable versions of GNU coreutils.

Affected Products

• GNU coreutils 9.2
• GNU coreutils 9.3
• GNU coreutils 9.4

Discovery Timeline

• 2024-02-06 - CVE-2024-0684 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-0684

Vulnerability Analysis

This heap overflow vulnerability (CWE-122, CWE-787) affects the split command-line utility included in GNU coreutils. The vulnerability arises from improper memory bounds checking within the line_bytes_split() function. When processing specially crafted input, the function fails to properly validate the size of user-controlled data before writing to a heap-allocated buffer, allowing an attacker to overflow the buffer with several hundred bytes of attacker-controlled data.

The attack requires local access to the system and low-level privileges to execute the split command. No user interaction is required for exploitation. While the vulnerability does not impact data confidentiality or integrity, successful exploitation results in complete loss of system availability for the affected component, crashing the split process.

Root Cause

The root cause of this vulnerability is an out-of-bounds write condition (CWE-787) combined with a heap-based buffer overflow (CWE-122) in the line_bytes_split() function. The function does not adequately validate input lengths before copying data into heap-allocated memory, allowing user-supplied data exceeding the expected buffer size to overwrite adjacent heap memory.

Attack Vector

The attack vector is local, requiring an attacker to have shell access or the ability to execute commands on the target system. The attacker must invoke the split utility with maliciously crafted arguments or input data designed to trigger the overflow condition in line_bytes_split(). Since the vulnerability requires only low privileges and no user interaction, any authenticated user on a multi-user system could potentially exploit this flaw to disrupt system operations that depend on the split utility.

The vulnerability manifests when the split command processes input data in line-bytes mode. When specially crafted input is provided, the improper bounds checking in line_bytes_split() allows heap memory corruption. For detailed technical analysis, refer to the Openwall OSS Security Discussion and the Red Hat Bug Report #2258948.

Detection Methods for CVE-2024-0684

Indicators of Compromise

• Unexpected crashes or segmentation faults in the split process
• Core dumps generated by the split utility with heap corruption signatures
• Unusual error messages or abnormal termination when running split commands
• Audit logs showing repeated failed split command executions

Detection Strategies

• Monitor system logs for crashes related to the split binary from coreutils
• Implement file integrity monitoring to detect unauthorized modifications to coreutils binaries
• Deploy application crash monitoring to detect unusual termination of the split process
• Use package version auditing to identify systems running vulnerable coreutils versions (9.2, 9.3, or 9.4)

Monitoring Recommendations

• Configure centralized logging to capture all coreutils-related crash events
• Set up alerts for repeated split command failures or abnormal termination patterns
• Monitor system resource utilization for signs of denial of service attacks targeting local utilities
• Implement vulnerability scanning to identify systems with unpatched coreutils installations

How to Mitigate CVE-2024-0684

Immediate Actions Required

• Update GNU coreutils to a patched version as provided by your Linux distribution
• Review and restrict access to the split utility on multi-user systems where appropriate
• Monitor for official patches from your operating system vendor
• Audit systems to identify all instances running vulnerable coreutils versions

Patch Information

Patches and security updates are available through various distribution channels. System administrators should consult the following resources for patch information:

• Red Hat CVE-2024-0684 Advisory
• Fedora Package Announcement
• NetApp Security Advisory NTAP-20240808-0001

Apply vendor-provided updates using your distribution's package manager (e.g., yum update coreutils, apt upgrade coreutils, or dnf update coreutils).

Workarounds

• Restrict access to the split command using file permissions or access control lists for untrusted users
• Implement shell restrictions to prevent untrusted users from executing coreutils commands directly
• Consider using alternative file splitting utilities if patching is not immediately possible
• Deploy application sandboxing for scripts or processes that invoke the split utility

# Check current coreutils version
split --version

# Example: Update coreutils on RHEL/CentOS/Fedora
sudo dnf update coreutils

# Example: Update coreutils on Debian/Ubuntu
sudo apt update && sudo apt upgrade coreutils

# Verify the update
split --version