Description
The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.24-1 | — |
| Debian 13 | glibc | 2.24-1 | — |
| Debian 12 | glibc | 2.24-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | glibc | 2.23-0ubuntu6 | USN-3239-1 |
| Ubuntu 14.04 LTS | eglibc | 2.19-0ubuntu6.10 | USN-3239-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | glibc | 2.34-1.2 | openSUSE-SU-2024:10792-1 |
Advisories 2
- USN-3239-1 eglibc, glibc vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10792-1 glibc-2.34-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2016-87dde780b8 vendor-advisory
- 92532 vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21995039
- FEDORA-2016-5f050a0a6d vendor-advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=20435
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=9e2ff6c9cc54c0b4402b8d49e4abe7000fde7617
- GLSA-201706-19 vendor-advisory
- FEDORA-2016-57cba655d5 vendor-advisory
- [oss-security] 20160818 CVE-2016-6323: Missing unwind information on ARM EABI (32-bit) causes backtrace generation to hang mailing-list
- openSUSE-SU-2016:2443 vendor-advisory