CVE-1999-0199
📋 TL;DR
This CVE describes a documentation issue in glibc's tdelete function where the return value behavior when deleting a tree's root was unspecified. This could lead developers to write code that accesses dangling pointers, potentially causing crashes or memory corruption. Only applications using tdelete function with specific patterns are affected.
💻 Affected Systems
- GNU C Library (glibc)
📦 What is this software?
Glibc by Gnu
The GNU C Library (glibc) is the core C library for Linux systems, providing essential system calls and basic functions for all C programs. It is a fundamental component that nearly every Linux application depends on.
Learn more about Glibc →⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, denial of service, or information disclosure in applications using tdelete with root deletion.
Likely Case
Application crashes or undefined behavior when tdelete is called to delete the root of a tree.
If Mitigated
No impact if applications don't use tdelete or properly handle its return values.
🎯 Exploit Status
Exploitation requires finding and targeting specific applications that misuse tdelete. No known public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: glibc 2.2 and later
Vendor Advisory: https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz
Restart Required: Yes
Instructions:
1. Update glibc to version 2.2 or later. 2. For source-based systems: compile and install glibc >=2.2. 3. For package managers: use system update commands (apt-get upgrade, yum update, etc.). 4. Restart affected services or reboot system.
🔧 Temporary Workarounds
Avoid tdelete root deletion
allModify application code to avoid calling tdelete on the root node of trees
# Review application source code for tdelete usage
# Ensure tdelete is not called on root nodes
🧯 If You Can't Patch
- Audit all applications for tdelete usage and root deletion patterns
- Implement strict memory protection mechanisms (ASLR, DEP) to reduce exploit impact
🔍 How to Verify
Check if Vulnerable:
Check glibc version: ldd --version | grep glibc. If version is below 2.2, system is vulnerable at library level.Check Version:
ldd --version | grep glibcVerify Fix Applied:
Verify glibc version is 2.2 or higher: ldd --version | grep glibc📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults in code using search/tree functions
- Memory corruption errors in application logs
Network Indicators:
- None - this is a local memory corruption issue
SIEM Query:
Process crashes with glibc search/tree functions OR segmentation faults in applications using tdelete🔗 References
- https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz
- https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40
- https://www.cee.studio/tdelete.html
- https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz
- https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40
- https://www.cee.studio/tdelete.html
