CVE-2025-3360: GLib Buffer Overflow Vulnerability

CVE-2025-3360 Overview

A vulnerability has been identified in GLib affecting the g_date_time_new_from_iso8601() function. When parsing a long invalid ISO 8601 timestamp, an integer overflow occurs which subsequently leads to a buffer under-read condition. This flaw is categorized under CWE-190 (Integer Overflow or Wraparound).

Critical Impact

Applications utilizing GLib's ISO 8601 timestamp parsing functionality may experience denial of service conditions when processing maliciously crafted timestamp strings.

Affected Products

• GLib (all versions using vulnerable g_date_time_new_from_iso8601() implementation)
• Applications and libraries dependent on GLib's date/time parsing functionality
• Linux distributions including Debian and Red Hat based systems

Discovery Timeline

• 2025-04-07 - CVE CVE-2025-3360 published to NVD
• 2025-04-14 - Last updated in NVD database

Technical Details for CVE-2025-3360

Vulnerability Analysis

The vulnerability exists within GLib's ISO 8601 timestamp parsing implementation, specifically in the g_date_time_new_from_iso8601() function. When this function receives an exceptionally long invalid ISO 8601 formatted timestamp string, it fails to properly validate the input length before performing arithmetic operations. This leads to an integer overflow condition where the calculated buffer position wraps around to an unexpected value, causing the subsequent read operation to access memory outside the intended buffer boundaries (buffer under-read).

The network attack vector indicates that applications accepting timestamp data from remote sources are potentially vulnerable. However, the high attack complexity required to trigger this condition reduces the practical exploitability of this flaw.

Root Cause

The root cause is an integer overflow vulnerability (CWE-190) in the timestamp parsing logic. The g_date_time_new_from_iso8601() function does not implement adequate bounds checking on input string length before performing size calculations. When the input exceeds expected boundaries, arithmetic operations on size values overflow, resulting in incorrect memory addressing and subsequent buffer under-read operations.

Attack Vector

The attack vector is network-based, requiring an attacker to supply a specially crafted, excessively long ISO 8601 timestamp string to an application using the vulnerable GLib function. The attack requires:

1. An application that accepts ISO 8601 timestamp input from network sources
2. The application passes this input to g_date_time_new_from_iso8601() without proper length validation
3. A malformed timestamp string of sufficient length to trigger the integer overflow
4. The resulting buffer under-read may cause the application to crash or potentially leak memory contents

Due to the high complexity required to successfully exploit this vulnerability and the limited impact (availability only), practical exploitation in real-world scenarios is challenging.

Detection Methods for CVE-2025-3360

Indicators of Compromise

• Unexpected application crashes in processes utilizing GLib's date/time parsing functions
• Core dumps or error logs indicating memory access violations in g_date_time_new_from_iso8601() or related GLib functions
• Abnormally long timestamp strings in application input logs

Detection Strategies

• Monitor application logs for segmentation faults or memory access errors related to GLib functions
• Implement input validation to detect and reject excessively long timestamp strings before they reach GLib parsing functions
• Deploy runtime memory protection tools that can detect buffer under-read attempts
• Use static analysis tools to identify code paths that pass untrusted input to g_date_time_new_from_iso8601()

Monitoring Recommendations

• Enable core dump collection and analysis for applications using GLib to identify exploitation attempts
• Monitor system logs for repeated crashes in applications that process timestamp data from external sources
• Implement alerting for applications that receive unusually large timestamp input values
• Track GLib-related security advisories from Red Hat and Debian for updated guidance

How to Mitigate CVE-2025-3360

Immediate Actions Required

• Update GLib to the latest patched version available from your distribution's package repositories
• Review applications that accept timestamp input from untrusted sources and implement input length validation
• Consider implementing a maximum length check on ISO 8601 timestamp strings before passing them to GLib functions
• Monitor the Red Hat CVE Advisory and Red Hat Bug Report for patch availability

Patch Information

Security patches are being tracked by major Linux distributions. Consult the following resources for the latest patch information:

• Red Hat CVE Advisory - Official Red Hat security advisory
• Red Hat Bug Report - Bug tracking for this vulnerability
• Debian LTS Announcement - Debian security update information

Apply updates through your distribution's standard package management system once patches become available.

Workarounds

• Implement application-level input validation to restrict ISO 8601 timestamp string length to reasonable bounds (e.g., 64 characters maximum for standard timestamps)
• Use alternative date/time parsing libraries that are not affected by this vulnerability if immediate patching is not possible
• Employ memory-safe compilation options (ASLR, stack canaries) to reduce exploitation impact
• Isolate applications processing untrusted timestamp data in sandboxed environments

# Example input validation before GLib parsing
# Add to application code or input processing layer
MAX_TIMESTAMP_LENGTH=64
if [ ${#timestamp_input} -gt $MAX_TIMESTAMP_LENGTH ]; then
    echo "Error: Invalid timestamp length"
    exit 1
fi