Bug 1336745 (CVE-2016-4804)

Summary:	CVE-2016-4804 dosfstools: Heap-buffer-overflows in read_fat() and get_fat() functions
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jskarvad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dosfstools 4.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-19 10:38:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1337499
Bug Blocks:	1336747

Description Andrej Nemec 2016-05-17 11:43:44 UTC

Multiple vulnerabilities were found in dosfstools. The variable used for storing the FAT size (in bytes) was an unsignedint. Since the size in sectors read from the BPB was not sufficiently checked, this could end up being zero after multiplying it with the sector size while some offsets still stayed excessive. Ultimately it would cause segfaults when accessing FAT entries for which no memory
was allocated.

External references:

https://github.com/dosfstools/dosfstools/issues/25
https://github.com/dosfstools/dosfstools/issues/26
https://blog.fuzzing-project.org/44-dosfstools-fsck.vfat-Several-invalid-memory-accesses.html


Upstream fix:

https://github.com/dosfstools/dosfstools/commit/e8eff147e9da1185f9afd5b25948153a3b97cf52

Comment 1 Huzaifa S. Sidhpurwala 2016-05-19 10:36:29 UTC

Created dosfstools tracking bugs for this issue:

Affects: fedora-all [bug 1337499]

Comment 2 Fedora Update System 2016-05-20 17:36:04 UTC

dosfstools-3.0.28-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2016-05-20 23:50:02 UTC

dosfstools-3.0.28-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-06-02 14:49:33 UTC

dosfstools-3.0.27-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.