Bug 1201309 (CVE-2014-9488)

Summary: CVE-2014-9488 less: out of bounds read access in is_utf8_well_formed()
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: cbuissar, jmlich, slawomir
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: less 475 Doc Type: Bug Fix
Doc Text:
An out of bound read, with a maximum of 5 bytes, was found in the way the is_utf8_well_formed() function parsed UTF-8 characters. If less was to be recompiled with an address sanitizer, a specially crafted input could crash less.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-12 13:38:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1201310    
Bug Blocks:    
Attachments:
Description Flags
CVE-2014-9488 less patch
none
CVE-2014-9488 less patch none

Description Martin Prpič 2015-03-12 13:36:06 UTC 
The following flaw was reported in less:

An out of bounds read access in the UTF-8 decoding can be triggered with a malformed file in the tool less. The access happens in the function is_utf8_well_formed (charset.c, line 534) due to a truncated multibyte character in the sample file. It affects the latest upstream less version 470. The bug does not crash less, it can only be made visible by running less with valgrind or compiling it with Address Sanitizer. The security impact is likely minor as it is only an invalid read access.

Additional information:

https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html
http://seclists.org/oss-sec/2015/q1/797
Comment 1 Martin Prpič 2015-03-12 13:36:54 UTC 
Created less tracking bugs for this issue:

Affects: fedora-all [bug 1201310]
Comment 2 Martin Prpič 2015-03-12 13:37:44 UTC 
Created attachment 1000986 [details]
CVE-2014-9488 less patch
Comment 3 Martin Prpič 2015-03-12 13:38:37 UTC 
Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Comment 4 Jozef Mlich 2015-06-01 07:09:47 UTC 
Created attachment 1033170 [details]
CVE-2014-9488 less patch

The function is_utf8_well_formed was defined in charset.c with single parameter. I was surprised, that it is even compiling.

This new patch is updating own implementation of function is_utf8_well_formed and fixing also its other use. The code is taken from Mark Nudelman's unreleased version of less.
Comment 6 Cedric Buissart 2018-05-03 14:48:56 UTC 
External References:

https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html