Bug 1178773
| Summary: | gnupg2: use-after-free in parse_keyserver_line() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | bcl, carnil, falonso, rdieter, tmraz |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | GnuPG 2.1.2 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-09 16:36:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1178774 | ||
| Bug Blocks: | 1178767 | ||
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. |
Use-after-free issue was reported in sm/gpgsm.c / parse_keyserver_line() [1]: sm/gpgsm.c: ... 839 if (fail) 840 { 841 log_info (_("%s:%u: skipping this line\n"), filename, lineno); 842 keyserver_list_free (server); 843 } 844 845 return server; ... If something in the keyserver_line failed, parse_keyserver_line would free 'server', but then return it afterwards, leading to a use-after-free. Upstream commit that fixes this: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=abd5f6752d693b7f313c19604f0723ecec4d39a6 [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773473