Bug 1339931 (CVE-2016-5029)

Summary:	CVE-2016-5029 libdwarf: Null pointer dereference in create_fullest_file_path()
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fche, orion
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:52:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1340128, 1340129
Bug Blocks:

Description Andrej Nemec 2016-05-26 08:36:06 UTC

A null pointer dereference vulnerability was found in libdwarf in create_fullest_file_path() function. This is due to corrupted dwarf and the fix detects this corruption and if that null string pointer happens undetected a static string is substituted so readers can notice the situation.

References (with a link to PoC):

http://seclists.org/oss-sec/2016/q2/393

External references:

https://www.prevanders.net/dwarfbug.html

Upstream fix:

https://sourceforge.net/p/libdwarf/code/ci/acae971371daa23a19358bc62204007d258fbc5e

Comment 1 Tom Hughes 2016-05-26 08:36:51 UTC

If you want to report an issue with the Fedora package then please do so against the proper component.

In the meantime please stop adding me to your RedHat internal security bugs.

Comment 2 Andrej Nemec 2016-05-26 13:42:02 UTC

Created libdwarf tracking bugs for this issue:

Affects: fedora-all [bug 1340128]
Affects: epel-6 [bug 1340129]