Bug 1022280 (CVE-2013-4458)

Summary:	CVE-2013-4458 glibc: Stack (frame) overflow in getaddrinfo() when called with AF_INET6
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ashankar, codonell, fweimer, jakub, jkurik, jrusnack, law, pfrankli, pfrields, sardella, schwab, spoyarek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-14 09:44:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1025612, 1111460
Bug Blocks:	1022282, 1101912

Description Vincent Danen 2013-10-22 22:41:17 UTC

A stack (frame) overflow flaw, which led to a denial of service (application crash), was found in the way glibc's getaddrinfo() function processed certain requests when called with AF_INET6.  A similar flaw to CVE-2013-1914, this affects AF_INET6 rather than AF_UNSPEC.

A proposed patch has been submitted for review [1].  No CVE has been assigned yet.

[1] https://sourceware.org/ml/libc-alpha/2013-10/msg00733.html

Comment 1 Vincent Danen 2013-10-23 04:13:05 UTC

Upstream bug report:

https://sourceware.org/bugzilla/show_bug.cgi?id=16072

Comment 2 Siddhesh Poyarekar 2013-10-28 11:22:09 UTC

Fix pulled into Fedora rawhide (2.18.90-13).

Comment 3 Huzaifa S. Sidhpurwala 2013-11-01 04:57:26 UTC

Statement:

This issue affects the versions of glibc as shipped with Red Hat Enterprise Linux 5. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata

Comment 7 Tomas Hoger 2014-06-12 10:23:17 UTC

Upstream fix:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=7cbcdb3699584db8913ca90f705d6337633ee10f

Comment 9 Martin Prpič 2014-10-10 08:43:55 UTC

IssueDescription:

It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash.

Comment 10 errata-xmlrpc 2014-10-14 04:42:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1391 https://rhn.redhat.com/errata/RHSA-2014-1391.html