Bug 1148231 (CVE-2014-3676)

Summary:	CVE-2014-3676 shim: heap-based buffer overflow flaw in IPv6 address parsing
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	chazlett, jrusnack, kbsingh, pholica, pjones, security-response-team, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	shim-0.7-8.el7	Doc Type:	Bug Fix
Doc Text:	A heap-based buffer overflow flaw was found the way shim parsed certain IPv6 addresses. If IPv6 network booting was enabled, a malicious server could supply a crafted IPv6 address that would cause shim to crash or, potentially, execute arbitrary code.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-11-04 18:50:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1148239, 1148240, 1152388
Bug Blocks:	1148235

Description Murray McAllister 2014-10-01 02:44:16 UTC

A heap-based buffer overflow flaw was found in shim when parsing IPv6 addresses. If IPv6 network booting were enabled, a malicious server could supply a crafted IPv6 address that would cause shim to crash or, potentially, execute arbitrary code.

Note that performing a secure boot over the network is not a common scenario.

Acknowledgements:

Red Hat would like to thank the SUSE Security Team for reporting this issue.

Comment 2 Murray McAllister 2014-10-01 02:57:38 UTC

The proposed patch for this issue is the same as in https://bugzilla.redhat.com/show_bug.cgi?id=1148230#c2

Comment 6 Murray McAllister 2014-10-14 03:59:42 UTC

Public now:

http://seclists.org/oss-sec/2014/q4/311

Comment 7 Murray McAllister 2014-10-14 04:02:45 UTC

Created shim tracking bugs for this issue:

Affects: fedora-all [bug 1152388]

Comment 9 Fedora Update System 2014-11-01 17:07:38 UTC

shim-0.8-1.fc22, shim-signed-0.8-1.fc22, mokutil-0.2.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Martin Prpič 2014-11-04 10:25:06 UTC

IssueDescription:

A heap-based buffer overflow flaw was found the way shim parsed certain IPv6 addresses. If IPv6 network booting was enabled, a malicious server could supply a crafted IPv6 address that would cause shim to crash or, potentially, execute arbitrary code.

Comment 11 errata-xmlrpc 2014-11-04 17:56:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1801 https://rhn.redhat.com/errata/RHSA-2014-1801.html

Comment 12 Fedora Update System 2014-11-12 02:36:04 UTC

mokutil-0.2.0-1.fc19, shim-signed-0.8-2 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2014-11-12 02:41:00 UTC

mokutil-0.2.0-1.fc20, shim-signed-0.8-3 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.