In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can     incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is     mishandled. (CVE-2019-7309)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the glibc package has been released.

The remote host is affected by the vulnerability described in GLSA-202006-04 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
248930	Linux Distros Unpatched Vulnerability : CVE-2019-7309	Nessus	Misc.	medium
144065	Photon OS 3.0: Glibc PHSA-2020-3.0-0171	Nessus	PhotonOS Local Security Checks	medium
143487	Photon OS 2.0: Glibc PHSA-2020-2.0-0303	Nessus	PhotonOS Local Security Checks	medium
143444	Photon OS 1.0: Glibc PHSA-2020-1.0-0343	Nessus	PhotonOS Local Security Checks	medium
137441	GLSA-202006-04 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2019-7309

medium

Tenable Plugins

medium

medium

medium

medium

critical