oss-security - CVE-2025-47153: out-of-bounds access in some 32-bit builds of Node.js

Follow @Openwall on Twitter for new release announcements and other news

Message-ID: <d56d1694-7625-4c73-889e-222afa21d2c3@oracle.com>
Date: Fri, 2 May 2025 09:25:34 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-47153: out-of-bounds access in some 32-bit
 builds of Node.js

https://lists.debian.org/debian-lts-announce/2025/05/msg00003.html announces:

    Node.js a popular server side javascript engine was affected by
    a vulnerability on 32bits architecture.

    Build processes for libuv and Node.js for 32-bit systems,
    have an inconsistent off_t size (e.g., building on i386 Debian always uses
    _FILE_OFFSET_BITS=64 for the libuv dynamic library,
    but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs),
    leading to out-of-bounds access.

[I thought this was interesting to bring to the list since I don't remember
  seeing _FILE_OFFSET_BITS mismatches assigned CVE ids in the past, though
  they clearly cause differing size calculations for 'struct stat' instances.
  One can easily imagine _TIME_BITS mismatches having the same effect as 32-bit
  builders start rolling out 64-bit time support to prepare for the year 2038.]

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.