CVE-2025-5278

What it actually does

Heap buffer under-read in GNU Coreutils sort begfield() function when processing crafted traditional key format options, allowing access to memory outside the allocated buffer and resulting in process crash or sensitive data leakage.

Why it matters to the business

Disruption to data processing workflows that rely on sort, with risk of exposing sensitive information from memory; low likelihood of remote exploitation but requires prompt patching on affected systems to avoid operational incidents.

How an attack unfolds

An attacker supplies a malicious command-line invocation of sort using the traditional key format that triggers the under-read condition in begfield(), causing the utility to access invalid memory and potentially crash or disclose data.

How to fix it

Upgrade affected GNU Coreutils packages to a fixed version; for linux-oracle on Ubuntu 18.04 LTS apply the update to 4.15.0-1105.116 or later equivalent coreutils package.

How to confirm the fix worked

Verify installed coreutils version is at or above the fixed release and test sort with sample traditional key format inputs to confirm absence of crashes or unexpected behavior.

Typical attack path

1. Identify systems running vulnerable GNU Coreutils sort
2. Craft input using traditional -k key specification that causes buffer under-read
3. Execute the sort command locally to trigger the flaw
4. Observe crash or inspect leaked memory contents

How to detect it

Review system and application logs for unexpected sort utility crashes or segmentation faults; examine command history for invocations using traditional key formats on unpatched systems.

What your security team should do

• Apply the listed fixed package versions immediately on all affected Ubuntu 18.04 systems
• Scan for custom scripts or automation that invoke sort with legacy key syntax
• Monitor for sort process crashes in system logs as a potential indicator of attempted exploitation