Bug 1009643 (CVE-2012-6686, CVE-2013-4357)

Summary:	CVE-2012-6686 CVE-2013-4357 glibc: stack overflow in getaddrinfo()'s use of alloca()
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ashankar, carnil, codonell, fweimer, jakub, jkurik, jrusnack, law, mfranc, pfrankli, pfrields, schwab, spoyarek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-10-28 06:03:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1009645

Description Vincent Danen 2013-09-18 19:12:17 UTC

It was reported [1],[2] that there are potential security problems with allocating memory in glibc's getaddrinfo() function.  As noted in the posting to the oss-security mailing list:

"I believe the analysis in this bug report is incorrect.  The security 
implications are unclear.  A straight copy of a long name to a stack 
buffer should trigger a crash because it hits the guard page, but even 
that could be a problem for daemons.

On the other hand, it's impossible to know for sure that no GCC version 
ever lays out the stack in such a way that we end up with a problem. 
Multi-threaded programs linking in script interpreters are more exposed 
to these problems, too."


[1] http://sourceware.org/bugzilla/show_bug.cgi?id=12671
[2] http://www.openwall.com/lists/oss-security/2013/08/22/4

Comment 3 Huzaifa S. Sidhpurwala 2013-10-28 06:01:28 UTC

This issue has been addressed in the previous versions of Red Hat Enterprise Linux 5 and 6 by the following advisories:

Red Hat Enterprise Linux 5:
http://rhn.redhat.com/errata/RHBA-2013-0022.html
https://bugzilla.redhat.com/show_bug.cgi?id=797096

Red Hat Enterprise Linux 6:
http://rhn.redhat.com/errata/RHBA-2012-0763.html
https://bugzilla.redhat.com/show_bug.cgi?id=797094

Comment 4 Huzaifa S. Sidhpurwala 2013-10-28 06:02:43 UTC

Statement:

This issue has already been addressed in Red Hat Enterprise Linux 5 via http://rhn.redhat.com/errata/RHBA-2013-0022.html and in Red Hat Enterprise Linux 6 via http://rhn.redhat.com/errata/RHBA-2012-0763.html

Comment 5 Huzaifa S. Sidhpurwala 2013-10-28 06:03:31 UTC

This issue does not affect the version of glibc as shipped with Fedora 18 and 19.

Comment 6 Martin Prpič 2015-02-24 13:00:49 UTC

This issue was incorrectly assigned a duplicate CVE ID, CVE-2012-6686, and should be referred to by the original ID: CVE-2013-4357.

Comment 8 Salvatore Bonaccorso 2020-02-08 14:06:24 UTC

Hi

I suggest to remove the CVE-2012-6686 in the subject and as alias for this bug. The CVE-2012-6686 has in meanwhile been properly rejected.

Regards,
Salvatore

Comment 9 Salvatore Bonaccorso 2020-02-08 14:08:11 UTC

See: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2012-6686