The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

The remote Ubuntu 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7634-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the strcmp implementation optimized for     Power10 processors. This could cause applications to crash, compute wrong results, or leak confidential     information. (CVE-2025-5702)

    It was discovered that the GNU C Library incorrectly handled the strncmp implementation optimized for     Power10 processors. This could cause applications to crash, compute wrong results, or leak confidential     information. This issue only affected Ubuntu 25.04. (CVE-2025-5745)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e489437b3d advisory.

    This update contains the following bug fixes and enhancements:
    * String function register clobbers specific to POWER10 machines (CVE-2025-5702, CVE-2025-5745).
    * Crashes in TLS management when auditors are used (rhbz#2330213)
    * Optimizations for x86-64 CPUs
    * Optimizations for AArch64 CPUs



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-851644b160 advisory.

    This update addresses two string function vulnerabilities specific to POWER10 machines (CVE-2025-5702,     CVE-2025-5745) and fixes a bug in TLS management when auditors are used (rhbz#2330213).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242200	Ubuntu 24.04 LTS / 25.04 : GNU C Library vulnerabilities (USN-7634-1)	Nessus	Ubuntu Local Security Checks	medium
240529	Fedora 41 : glibc (2025-e489437b3d)	Nessus	Fedora Local Security Checks	medium
240346	Fedora 42 : glibc (2025-851644b160)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-5745

medium

Tenable Plugins

medium

medium

medium