CVE-2020-1751

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-17 · updated 2026-10-14
Weakness: CWE-787

Description

An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 19.10
GNU C Library (glibc): before 2.31 — fixed in 2.31
Red Hat Enterprise Linux: 8.0

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.31. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
https://security.gentoo.org/glsa/202006-04
https://security.netapp.com/advisory/ntap-20200430-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=25423
https://usn.ubuntu.com/4416-1/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
https://security.gentoo.org/glsa/202006-04
https://security.netapp.com/advisory/ntap-20200430-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=25423
https://usn.ubuntu.com/4416-1/
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2020-1751 or the next vulnerability affects your stack