Bug 1319648 (CVE-2016-3189)
| Summary: | CVE-2016-3189 bzip2: heap use after free in bzip2recover | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED WONTFIX | QA Contact: | |||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | unspecified | CC: | cbuissar, henri, jamartis, ovasik, sardella, security-response-team, slawomir | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: |
A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. An attacker could use this flaw by sending a specially crafted bzip2 file to recover and force the program to crash.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-06-20 12:56:55 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1348179, 1348180, 1348181 | ||||||
| Bug Blocks: | 1319653 | ||||||
| Attachments: |
|
||||||
|
Description
Andrej Nemec
2016-03-21 09:17:22 UTC
Acknowledgments: Name: Aladdin Mubaied Created attachment 1169843 [details]
Proposed patch, by Jakub Martisko
== Analysis from Jakub Martisko == During the first phase (where the program identifies starts and ends of the blocks), blockEnd of the first block is set to be blockStart-1. Similarly for block 3. During the second phase, the first block is ignored (it is not long enough), the second block is recovered correctly and the third one leads to crash. The cause of crash is, that because the end of this block is set to be one bit before its start, it tries to write the end stream sequence (sqrt(PI)....), however since it writes its end before the start, no file is opened and this leads to crash. Problem is, that after closing the output file, the second block does not set variable "outFile" to NULL. Third block then checks this variable and because it is not NULL, it tries to write to the output stream, which was closed with bsClose(). As for the fix, it seems to be enough to add "outFile=NULL;" to the end of block that is responsible for creation of the end of stream sequence (patch attached). Created bzip2 tracking bugs for this issue: Affects: fedora-all [bug 1348179] Created mingw-bzip2 tracking bugs for this issue: Affects: fedora-all [bug 1348180] Affects: epel-7 [bug 1348181] Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. |