CVE-2024-0684: 
NixOS vulnerability analysis and mitigation

A heap overflow vulnerability (CVE-2024-0684) was discovered in the GNU coreutils "split" program affecting versions 9.2, 9.3, and 9.4. The vulnerability was introduced on March 4, 2023, through commit 40bf1591b and was fixed on January 18, 2024. The flaw allows a heap overflow with user-controlled data of multiple hundred bytes in length to occur in the line_bytes_split() function (NVD, Openwall).

The vulnerability exists in the line_bytes_split() function where a buffer overflow can occur during memory copying operations. The issue was introduced when the code handling the hold buffer size was modified, removing important size checks. The vulnerability has a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access is required (NVD, Red Hat).

When successfully exploited, this vulnerability can lead to an application crash and denial of service. The heap overflow involves user-controlled data of multiple hundred bytes in length, which could potentially be leveraged to cause system instability (NVD, Openwall).

The vulnerability has been fixed in GNU coreutils with commit c4c5ed8f4e9cd55a12966d4f520e3a13101637d9. Users are advised to update to the latest version of GNU coreutils that includes this fix (Openwall).