CVE-2024-0911: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2024-0911) was discovered in GNU Indent version 2.2.13, a program used for formatting C code. The vulnerability was reported on January 20, 2024, and allows an attacker to trigger a heap-based buffer overflow by tricking a user into processing a specially crafted file (GNU Indent Bug, NVD).

The vulnerability exists in the set_buf_break function located in indent/src/output.c line 319, where a heap-based buffer overflow occurs during a read operation of size 2. The issue is triggered when processing specially crafted input files. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause the application to crash through a heap-based buffer overflow. The impact is primarily limited to availability, with no direct impact on confidentiality or integrity of the system (Red Hat CVE).

The vulnerability has been fixed in subsequent releases of GNU Indent. Various Linux distributions have released security patches to address this vulnerability. Users are advised to update to the latest version of the software through their respective package managers (Debian Tracker).