CVE-2024-52533

What it actually does

Off-by-one error in SOCKS4 proxy connection message handling leads to a one-byte buffer overflow, enabling memory corruption that can result in arbitrary code execution or application crashes.

Why it matters to the business

Systems relying on GNOME GLib for network proxy functionality, particularly SOCKS4, face risk of remote compromise or service disruption, potentially affecting applications and services across Linux environments.

How an attack unfolds

An attacker positions themselves as a SOCKS4 proxy or intercepts traffic to send a specially crafted response that exceeds the expected message length by one byte due to missing null terminator handling, triggering the overflow.

How to fix it

Update GNOME GLib to the version containing commit bd40fbba132fb3d6e5d785ae9d2b05a9e0da8409 or later. Ensure all dependent applications are rebuilt against the patched library.

How to confirm the fix worked

Verify the presence of the fix by checking the source code for updated SOCKS4_CONN_MSG_LEN definition or test with a proxy connection that includes the trailing null character.

Typical attack path

1. Identify applications using GLib with SOCKS4 proxy configuration
2. Compromise or spoof the proxy server to deliver malicious response
3. Send crafted SOCKS4 message to trigger buffer overflow
4. Exploit memory corruption for code execution or DoS

How to detect it

Look for crashes in applications linked against GLib during SOCKS4 proxy usage in system logs or core dumps; monitor for unusual network traffic patterns involving proxy connections.

What your security team should do

• Prioritize patching GLib in all affected environments
• Monitor for updates in distributions using GLib
• Review proxy configurations to avoid SOCKS4 if possible until patched
• Test applications for stability after update