Bug 1029664 (CVE-2013-4560)
| Summary: | CVE-2013-4560 lighttpd: Use after free if FAMMonitorDirectory fails | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Kurt Seifried <kseifried> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ccoleman, dmcphers, jialiu, lmeyer, matthias, mmcgrath |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-09-05 19:10:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1029666, 1029667, 1029669 | ||
| Bug Blocks: | |||
Created lighttpd tracking bugs for this issue: Affects: fedora-all [bug 1029666] Created lighttpd tracking bugs for this issue: Affects: epel-all [bug 1029667] |
Stefan Bühler of the lighthttpd project reports: Use after free if FAMMonitorDirectory fails ============================================= Description ------------- If the "fam" is enabled: server.stat-cache-engine = "fam" and there are directories reachable from configured doc roots and aliases on which FAMMonitorDirectory fails (probably depends on file system), a remote client could trigger a DoS. This bug was found with the clang static analyzer. Detailed analysis ------------------- If FAMMonitorDirectory fails, the memory intended to store the context is released; some lines below the "version" compoment of that context is read. Reading invalid data doesn't matter, but the memory access could trigger a segfault. Affected versions ------------------- All versions before 1.4.33. Patch ------- See http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_fam_use_after_free.patch Fixed in ---------- 1.4.x: http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2921 1.4.34: not released yet (http://www.lighttpd.net/) Solutions or workaround ------------------------- Don't enable "fam". References ------------ [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-XXXX (TBD) [2] http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2921/diff/ GPG signatures ---------------- * http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_fam_use_after_free.patch.asc * http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt.asc