Bug 1126695

Summary:	llvm: resource consumption issue in C++ regex library
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ajax, bos, davejohansen, dmalcolm, jv+fedora, jwakely, petersen, scottt.tw, spacewar, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-08-12 03:52:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1126696, 1126697, 1126698, 1126699
Bug Blocks:

Description Murray McAllister 2014-08-05 05:42:47 UTC

Maksymilian Arciemowicz reported a resource consumption issue in the libcxx C++ regex library. If an attacker were able to make an application using this library process a specially-crafted regular expression, it could cause the application to consume excessive system resources.

Original report:

http://seclists.org/fulldisclosure/2014/Aug/1

Upstream bug:

http://llvm.org/bugs/show_bug.cgi?id=20291

A patch is not yet available. Currently on Fedora, this requires compiling the affected program with the experimental ISO C++ 2011 support by using the "-std=c++11" option.

Comment 1 Murray McAllister 2014-08-05 05:43:59 UTC

Created llvm tracking bugs for this issue:

Affects: fedora-all [bug 1126696]
Affects: epel-6 [bug 1126698]
Affects: epel-7 [bug 1126699]

Comment 2 Murray McAllister 2014-08-05 05:44:03 UTC

Created mingw-llvm tracking bugs for this issue:

Affects: fedora-all [bug 1126697]

Comment 3 Murray McAllister 2014-08-05 05:51:38 UTC

CVE request: http://www.openwall.com/lists/oss-security/2014/08/05/4

Comment 4 Dave Johansen 2014-08-05 14:36:16 UTC

Does this only apply to libcxx and not libstdc++? Because libstdc++ is used and not libcxx on EPEL 6/7 (and also on Fedora I believe).

Comment 5 Murray McAllister 2014-08-07 07:54:15 UTC

Sorry for the confusion (and spam). I think it may only be libcxx

Comment 6 Jonathan Wakely 2014-08-07 09:27:11 UTC

This is not relevant to RHEL or Fedora, libc++ issues don't belong here.

Comment 7 Dave Johansen 2014-08-12 03:52:48 UTC

libstdc++ is used and not libc++ so this issue does not effect RHEL/Fedora.