CVE-2025-9175
📋 TL;DR
A stack-based buffer overflow vulnerability in neurobin shc up to version 4.0.3 allows local attackers to execute arbitrary code or cause denial of service. The vulnerability exists in the 'make' function of src/shc.c and requires local access to exploit. Users of shc versions up to 4.0.3 are affected.
💻 Affected Systems
- neurobin shc
📦 What is this software?
Shc by Neurobin
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to complete system compromise, arbitrary code execution as the user running shc, or denial of service.
Likely Case
Local user gains elevated privileges or crashes the shc process, potentially affecting dependent scripts or systems.
If Mitigated
Limited impact due to local-only exploitation and proper access controls restricting who can run shc.
🎯 Exploit Status
Exploit details are publicly available but require local access and understanding of buffer overflow techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.0.4 or later
Vendor Advisory: https://github.com/neurobin/shc/releases
Restart Required: No
Instructions:
1. Check current shc version with 'shc -v'. 2. Update shc using package manager or compile from source. 3. For source installation: git clone https://github.com/neurobin/shc.git, cd shc, ./configure, make, sudo make install.
🔧 Temporary Workarounds
Restrict shc execution
allLimit which users can execute shc to reduce attack surface
sudo chmod 750 /usr/local/bin/shc
sudo chown root:trustedgroup /usr/local/bin/shc
Remove shc temporarily
allUninstall shc until patched if not critically needed
sudo apt remove shc
sudo yum remove shc
sudo make uninstall (from source install)
🧯 If You Can't Patch
- Implement strict access controls to limit which users can run shc
- Monitor for unusual shc execution patterns or crashes
🔍 How to Verify
Check if Vulnerable:
Run 'shc -v' and check if version is 4.0.3 or earlierCheck Version:
shc -vVerify Fix Applied:
After update, run 'shc -v' to confirm version is 4.0.4 or later📡 Detection & Monitoring
Log Indicators:
- Multiple shc process crashes
- Unusual shc execution by non-privileged users
- Segmentation faults in shc processes
Network Indicators:
- None - local-only vulnerability
SIEM Query:
process.name="shc" AND (event.action="segmentation_fault" OR event.action="crash")