An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton.
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
| Link | Tags |
|---|---|
| https://gitlab.redox-os.org/redox-os/relibc/-/issues/200 | exploit issue tracking |
| https://gitlab.redox-os.org/redox-os/relibc/-/merge_requests/569 | exploit |
| https://github.com/Marsman1996/pocs/blob/master/redox/CVE-2024-57492/README.md | exploit third party advisory |