Red Hat Patches glibc iconv Out-of-Bounds Write With RCE Potential

Red Hat released Important glibc security updates for Red Hat Enterprise Linux 7, 8, and 9—including extended, advanced-update, and extended-lifecycle support channels—to remediate CVE-2024-2961. The flaw affects the ISO-2022-CN-EXT iconv conversion module: incomplete internal-buffer checks for SS2 and SS3 charset-switch escape sequences during UCS-4 conversion can write one to three bytes beyond the intended buffer. Red Hat assigned the issue a CVSS v3.1 score of 8.8; successful exploitation may cause memory corruption, denial of service, privilege escalation, or remote code execution depending on the calling application and conditions.

The updates also resolve four glibc/nscd netgroup-cache vulnerabilities, including a stack-based buffer overflow, null-pointer dereferences, allocation-failure daemon termination, and unsafe handling of NSS callback strings. Administrators should deploy the updated glibc packages across affected x86_64, ARM64/aarch64, IBM Z/s390x, and IBM Power architectures, then restart all glibc-linked services or reboot hosts. Where patching cannot be performed immediately, Red Hat recommends disabling the vulnerable ISO-2022-CN-EXT gconv module and rebuilding the iconv cache; fixes were also issued for OpenShift Container Platform 4.12 through 4.16.