Description

An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T16:17:46.917Z",
  "pubdate": "2026-08-28T16:17:46.917Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability has been identified within the seekdir() function of the relibc library, specifically affecting commit 61f42d.\nThe vulnerability allows an attacker to terminate or hang the affected process by providing a crafted input during directory stream manipulation.\nThis flaw resides in the implementation of the directory entry handling logic, where insufficient validation or error handling of input offsets leads to an unstable state.\nSuccessful exploitation results in the disruption of service availability for the application utilizing relibc, potentially leading to resource exhaustion or process crashes.\nThe issue is localized to the internal handling of seek operations within /dirent/mod.rs, and requires an attacker to interact with the target process in a way that triggers the vulnerable seekdir() call.\nGiven that this occurs at the library level, any software statically or dynamically linked against this specific commit of relibc may be susceptible to exploitation if they expose directory navigation functionality to untrusted input.",
  "technicalDetails": "The vulnerability is situated within the seekdir() function implemented in /dirent/mod.rs of the relibc project, specifically at commit 61f42d.\nThe root cause involves improper handling of the 'loc' (location) argument provided to seekdir(), which is intended to set the position of the next readdir() call for the given directory stream.\nIn the affected implementation, the function fails to adequately sanitize or validate the provided offset value, leading to an out-of-bounds access or an invalid internal state management when attempting to reposition the directory entry pointer.\nThe attack flow begins when an attacker supplies a specifically crafted input that is subsequently passed to the seekdir() function via a user-controlled application interface. By passing an unexpected or malicious offset value, the attacker forces the internal dirent structure into a state where subsequent operations, such as directory iteration or stream cleanup, result in a segmentation fault or an infinite loop.\nWhen seekdir() is invoked with this crafted input, the internal pointer arithmetic performed by the library fails to reconcile the offset with the current directory buffer. This leads to the corruption of the directory stream's internal metadata. Once the state is corrupted, any subsequent call to readdir() or closedir() attempts to operate on invalid memory addresses or inconsistent data structures.\nThe impact is significant because relibc is a core component providing C library functionality. A DoS here translates to the crash of any service relying on directory operations. Because the vulnerability exists within the library's internal logic, the crash is typically unrecoverable by the host application, leading to immediate termination.\nThe exploitation does not necessarily require high privileges; it is constrained by the access permissions the target process holds for the directory in question. However, the requirement is that the attacker must be able to influence the input parameters provided to the seekdir() function through an application-level vector. No complex network protocol manipulation is required if the attacker already has local interaction capabilities with the target software."
}