CVE-2019-1010024.toml

# glibc ASLR bypass using cache of thread stack and heap.
# This is an information-disclosure / defence-bypass bug that requires an
# attacker with a pre-existing local read primitive in the process. The
# 5-Spot controller exposes no such primitive: it has no FFI, no memory
# read / write endpoints, and handles only Kubernetes-mediated inputs.
cve = "CVE-2019-1010024"
status = "not_affected"
justification = "vulnerable_code_cannot_be_controlled_by_adversary"
impact_statement = "An attacker has no primitive within the 5-Spot controller to leak cached stack/heap addresses, so the ASLR-bypass precondition is absent."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"