Bug 1149081 (CVE-2014-3683)

Summary:	CVE-2014-3683 rsyslog: integer overflow in PRI parsing
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aavati, bleanhar, ccoleman, dmcphers, jdetiber, jialiu, jkeck, jlieskov, jokerman, kseifried, lkundrak, lmeyer, mah.darade, mmccomas, nlevinki, pvrabec, rfortier, rhs-bugs, shaines, smohan, ssaha, theinric, vanmeeuwen+fedora, vbellur, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rsyslog 7.6.7, rsyslog 8.4.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-03 11:59:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1141341

Description Tomas Hoger 2014-10-03 07:57:44 UTC

An integer overflow flaw was found in the way rsyslog and sysklogd daemons parsed PRI (priority value, that combines values for facility (such as mail, cron, or authpriv) and severity/level (such as crit, info, debug)) values form the log message provided to the syslog daemon.  This problem could lead to bypass of the CVE-2014-3634 (bug 1142373) fix.

The rsyslog upstream fixed this issue in version 7.6.7 and 8.4.2:

http://lists.adiscon.net/pipermail/rsyslog/2014-October/038516.html
http://lists.adiscon.net/pipermail/rsyslog/2014-October/038515.html

A proposed fix for sysklogd is attached in bug 1142373 comment 16.

Acknowledgment:

Red Hat would like to thank the rsyslog upstream for reporting this issue. Upstream acknowledges mancha as the original reporter.

External References:

http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/

Comment 1 Tomas Hoger 2014-10-03 11:25:44 UTC

Further details of the impact of the original issue CVE-2014-3634 can be found in bug 1142373 comment 20.

This integer overflow may cause f_pmask[] over-read (bug 1142373 comment 21) have worse impact on sysklogd and rsyslog 3.x, making it possible to reliably crash those versions.

The textpri() impact on sysklogd and rsyslog 3.x is unchanged.  In case of rsyslog 5.x and 7.x, this may give an attacker a better control over what memory will be used as facility name or length of the facility name, which may result in easier exploitation of the flaw.

Comment 2 Tomas Hoger 2014-10-03 11:57:33 UTC

While upstream advisory indicates this issue is an incomplete fix of CVE-2014-3634, the real problem was actually introduced by CVE-2014-3634 patches.  Before those patches, there was an overflow in the way PRI value was parsed.  Hence, syslog could use negative PRI value internally.  However, the way facility number was extracted from PRI value using LOG_FAC ensured that the negative facility value was not used.

The issue was corrected upstream via the following commit:

http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=8a4ada4

The rsyslog upstream also provided updated patches for 3.x and 5.x that fix CVE-2014-3634 without introducing CVE-2014-3683 - see bug 1142373 comment 13, bug 1142373 comment 14 and bug 1142373 comment 29.

Comment 3 Tomas Hoger 2014-10-03 11:59:55 UTC

Statement:

This issue did not affect the versions of sysklogd and rsyslog packages as shipped with Red Hat Enterprise Linux 5, 6, and7.