GNU Glibc Vulnerable to Memory Corruption via Heap Buffer Overflow during 'assert()' Failure (CVE-2025-0395)

Brocade ASC-Gateway OVA

1 more products

35919

29 July 2025

08 July 2025

CLOSED

MEDIUM

7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-0395

Brocade Security Advisory ID

 BSA-2025-2903

Component

 Glibc

 

 

Summary

GNU Glibc contains a memory corruption vulnerability that overflows the heap buffer by one or several bytes. The corruption occurs when the assert() function fails under specific conditions. Heap buffer overflows are known to result in severe damage to the program's confidentiality, integrity, and availability, however the credited researchers have only demonstrated denial-of-service (DoS) via segmentation fault, and the vendor believes the vulnerability is relatively minor. It may only be exploited via custom setuid programs, and none of the known/default UNIX programs are affected.

Products Affected

  • Brocade Fabric OS versions 9.1.0 through 9.2.1b and 9.2.2
  • Brocade SANnav base OS (OVA deployment) versions before 2.4.0a
  • Brocade ASCG base OS (OVA deployment) versions before 3.3.0

Products Confirmed Not Affected

  • Brocade Fabric OS versions 9.0.0 through 9.0.1e1 - [VEX Justification: Vulnerable_code_not_present]
  • Brocade Fabric OS versions before 9.0 - [VEX Justification: Component_not_present]
  • Brocade SANnav standard deployments are not affected by this vulnerability - [VEX Justification: Vulnerable_code_cannot_be_contolled_by_adversary]
  • Brocade ASCG standard deployments are not affected by this vulnerability - [VEX Justification: Vulnerable_code_cannot_be_contolled_by_adversary]

Solution

  • Security update provided in Brocade Fabric OS 9.2.1c and 9.2.2a
  • Security update provided in Brocade SANnav base OS (OVA deployment) 2.4.0a
  • SANnav base OS Security update also provided in the sannav_ova_8x_os_05_2025 OVA patch. The OVA patch can be applied to 2.3.0, 2.3.0a, 2.3.1, 2.3.1a, 2.3.1b, 2.4.0 versions
  • Security update provided in Brocade ASCG base OS (OVA deployment) 3.3.0

Credit

The issue was found during security testing. 

 

Revision History

Version

Change

Date

1.0

Initial Publication

July 8, 2025

1.1

Added security update in FOS 9.2.1c

 July 22, 2025

 

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.