CVE-2019-7309

glibc: memcmp function incorrectly returns zero

Loading…

Severity

Low

Red Hat Product Security

3.3

CVSS 3.0

Review impact separately from score.

Published · February 2, 2019

Updated · October 14, 2026

Description

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

Statement

This issue only affects x32 arch, which is not supported in Red Hat Enterprise Linux kernels (CONFIG_X86_X32 is not set). Therefore glibc packages shipped with Red Hat Enterprise Linux are not affected.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 3.3
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-393 · Return of Wrong Status Code