CVE-2020-29573: 
NixOS vulnerability analysis and mitigation

CVE-2020-29573 affects the GNU C Library (glibc) before version 2.23 on x86 targets. The vulnerability was discovered in the sysdeps/i386/ldbl2mpn.c component, where a stack-based buffer overflow occurs when the printf family of functions processes an 80-bit long double with a non-canonical bit pattern. The issue was identified in December 2020 and does not affect glibc by default in versions 2.23 or later (from 2016 onwards) due to commits made in 2015 for inlining of C99 math functions through use of GCC built-ins (NVD, Bugzilla).

The vulnerability occurs in the printf family of functions when processing an 80-bit long double with a non-canonical bit pattern. The specific issue involves the behavior of isnan/__builtin_isnan on bit patterns that do not correspond to CPU-produced valid inputs. The isnan check in PRINTF_FP_FETCH assumes GCC behavior that returns true for non-normal numbers not specified as NaN, while the glibc implementation returns false. This discrepancy can be triggered by passing a specific value like \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 to sprintf. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

When successfully exploited, this vulnerability could lead to a Denial of Service (DoS) condition. The issue affects the system's ability to handle certain floating-point number formats, potentially causing system instability or crashes when processing malformed input (NetApp Advisory).

The vulnerability can be triggered by passing specific non-canonical bit patterns to the printf family of functions. A proof-of-concept exists using the value \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 when passed to sprintf (Bugzilla).

The primary mitigation is to upgrade to glibc version 2.23 or later. The issue was fixed in glibc 2.33 through a commit that updates the implementation of __mpn_extract_long_double to produce regularly shaped multi-precision integers, avoiding undefined behavior in __printf_fp_l. For systems that cannot upgrade, there are no known workarounds (Bugzilla, Patch).