Bug 1339929 (CVE-2016-5028)

Summary: CVE-2016-5028 libdwarf: Null pointer dereference in print_frame_inst_bytes()
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: fche, orion
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:52:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1340128, 1340129    
Bug Blocks:    

Description Andrej Nemec 2016-05-26 08:29:49 UTC 
A null pointer dereference vulnerability was found in libdwarf. It exists due to a corrupted object file. Libdwarf was not dealing with empty (bss-like) sections since it really did not expect to see such in sections it reads. Now libdwarf catches the object error so dwarfdump sees the section as empty.

References (with a link to PoC):

http://seclists.org/oss-sec/2016/q2/393

External references:

https://www.prevanders.net/dwarfbug.html

Upstream fix:

https://sourceforge.net/p/libdwarf/code/ci/a55b958926cc67f89a512ed30bb5a22b0adb10f4
Comment 1 Tom Hughes 2016-05-26 08:34:35 UTC 
If you want to report an issue with the Fedora package then please do so against the proper component.

In the meantime please stop adding me to your RedHat internal security bugs.
Comment 2 Andrej Nemec 2016-05-26 13:41:55 UTC 
Created libdwarf tracking bugs for this issue:

Affects: fedora-all [bug 1340128]
Affects: epel-6 [bug 1340129]