Bug 1287629 (CVE-2015-8385)
| Summary: | CVE-2015-8385 pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | adam.stokes, andrew, carnil, erik-fedora, jgrulich, jorton, lkundrak, mclasen, mmaslano, ppisar, rcollet, rmeggins, sardella, slawomir, walters, webstack-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | pcre 8.38 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-15 13:39:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1250946, 1287630, 1287631, 1287632, 1287634, 1330455, 1330456, 1330508, 1330509 | ||
| Bug Blocks: | 1287727 | ||
| Attachments: | |||
|
Description
Adam Mariš
2015-12-02 13:13:46 UTC
Created pcre tracking bugs for this issue: Affects: fedora-all [bug 1287630] Created glib2 tracking bugs for this issue: Affects: fedora-all [bug 1287632] Created mingw-pcre tracking bugs for this issue: Affects: fedora-all [bug 1287631] Affects: epel-7 [bug 1287634] Correspond to item 5 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup Fixed in upstream with:
commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date: Sat May 16 11:05:40 2015 +0000
Fix named forward reference to duplicate group number overflow bug.
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824-
cb99058d5e15
This is a duplicate of bug #1250943. (In reply to Petr Pisar from comment #5) > commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447 > Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> > Date: Sat May 16 11:05:40 2015 +0000 > > Fix named forward reference to duplicate group number overflow bug. Upstream commit link: http://vcs.pcre.org/pcre?view=revision&revision=1559 (In reply to Petr Pisar from comment #6) > This is a duplicate of bug #1250943. Why do you believe those are duplicates? I see the issue in bug 1250943 is associated with upstream rev1585. The pattern used in test for rev1559 (i.e. this issue) triggers valgrind errors down to version 8.01. (In reply to Tomas Hoger from comment #8) > (In reply to Petr Pisar from comment #6) > > This is a duplicate of bug #1250943. > > Why do you believe those are duplicates? I see the issue in bug 1250943 is > associated with upstream rev1585. The pattern used in test for rev1559 > (i.e. this issue) triggers valgrind errors down to version 8.01. I mistaken bug numbers probably. This bug #1287629 seems to be duplicate of bug #1250943. (In reply to Petr Pisar from comment #9) > I mistaken bug numbers probably. > > This bug #1287629 seems to be duplicate of bug #1250943. The above refers to the same bugs as comment 6. (In reply to Tomas Hoger from comment #10) > (In reply to Petr Pisar from comment #9) > > I mistaken bug numbers probably. > > > > This bug #1287629 seems to be duplicate of bug #1250943. > > The above refers to the same bugs as comment 6. I'm sorry. I got lost. I cannot find any duplicate in the Bugzilla now. My testing shows this issue was introduced in version 8.01 via the following change: http://vcs.pcre.org/pcre?view=revision&revision=488 https://bugs.exim.org/show_bug.cgi?id=947 It's difficult to port the fix to 8.32 version. The reason is upstream refactored the named/numbered group handling (from a static to dynamic look-up table) in "Refactor the code for creating the name/number table" commit that is newer than 8.32 version. I have a patch set of tree patches that together fixes thi bug while passing all tests, but I don't have good feeling of it. I will attach them here. Is really necessary to address this bug? Created attachment 1152231 [details]
Fix-duplicate-names-memory-calculation-error (1/3)
Created attachment 1152232 [details]
Fix-named-forward-reference-to-duplicate-group-numbe.patch (2/3)
Created attachment 1152233 [details]
Fix-buffer-overflow-for-named-references-in-situatio.patch
(In reply to Petr Pisar from comment #15) > Is really necessary to address this bug? Yes, this is something we should fix, as it's memory corruption issue. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:1025 https://rhn.redhat.com/errata/RHSA-2016-1025.html This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html |