util-linux Heap Buffer Overread Vulnerability in SUID Login-Utils

A heap buffer overread vulnerability has been identified in util-linux, specifically within the setpwnam() function. This issue arises when processing 256-byte usernames, leading to a heap buffer overread. The vulnerability affects SUID (Set User ID) login-utils utilities that write to the password database.

Impact

Exploitation of this vulnerability causes a heap buffer overread, which can lead to a segmentation fault or crash by causing memory to be read outside the bounds of the buffer. This is particularly likely when the code reads a variable amount of data and assumes a sentinel, such as a NUL in a string, will stop the read operation.