[Dev]

This is a 24 year old exploit that was only recently found.

... a flaw in the GNU C Library’s (glibc) iconv function (CVE-2024-2961) carries severe implications for web applications built on PHP. ...

Well shit. Please note, you actually have to have a php application that uses the exploitable functions to be at risk.

... The vulnerability, cataloged under CVE-2024-2961 and rated 8.8 on the CVSS scale, resides in the ISO-2022-CN-EXT plugin of the glibc’s iconv library. This critical flaw occurs during the charset conversion process from UCS4, where specific escape characters are required to signify changes in the charset to the library. However, due to insufficient boundary checks on internal buffers, an out-of-bounds write can occur, allowing up to three bytes to be written outside the intended memory area. ...

...
> The iconv() function in the GNU C Library versions 2.39 and older may
> overflow the output buffer passed to it by up to 4 bytes when converting
> strings to the ISO-2022-CN-EXT character set, which may be used to
> crash an application or overwrite a neighbouring variable.
>
> ISO-2022-CN-EXT uses escape sequences to indicate character set changes
> (as specified by RFC 1922).  While the SOdesignation has the expected
> bounds checks, neither SS2designation nor SS3designation have its;
> allowing a write overflow of 1, 2, or 3 bytes with fixed values:
> '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'.
...

For an actual write up on how it operates, refer to this

source Spoiler

https://securityonline.info/cve-2024-296...mediately/
https://adamgold.github.io/posts/basic-h...-of-force/
https://research.checkpoint.com/2020/saf...primitive/
https://www.openwall.com/lists/oss-secur...24/04/18/4

[YesMyDark]

But you need to be able to control the output format of iconv, right? I don't know if that's really a common thing tbh

[fl4nker]

Buffer overflows never get old, literally

[Dev]

But you need to be able to control the output format of iconv, right? I don't know if that's really a common thing tbh

Pretty much, the application has to change character encoding from any time to ISO-2022-CN-EXT character set, which is fairly specific in nature

[joepa]

Whooow this is good stuff! TY for sharing.