Bug 1343393

Summary:	nodejs: Missing check for negative length arguments to Buffer() and Buffer.allocUnsafe()
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, abhgupta, ahardin, apevec, ayoung, bleanhar, bmontgom, cbuissar, ccoleman, chrisw, cvsbot-xmlrpc, dbaker, dedgar, dmcphers, eparis, hhorak, jburrell, jgoulding, jialiu, jjoyce, jkeck, joelsmith, jokerman, jorton, jschluet, kbasil, lhh, lmeyer, lpeer, markmc, mchappel, mmccomas, mrunge, nodejs-maint, nodejs-sig, nstielau, rbryant, sclewis, sgallagh, sponnaga, srevivo, tchollingsworth, tdawson, tdecacqu, thrcka, tiwillia, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that nodejs Buffer module could accept a negative length for buffer allocation size. An attacker with ability to manipulate a buffer length could use this flaw to crash the application, or possibly execute arbitrary code in the context of the nodejs application.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-20 21:15:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1343394, 1343395, 1343396, 1417967, 1417968
Bug Blocks:	1343398, 1412811

Description Adam Mariš 2016-06-07 09:06:36 UTC

There was a missing check for negative parameter value in Buffer() and Buffer.allocUnsafe(). When user input is passed unchecked to the Buffer constructor or allocUnsafe(), it can expose parts of the memory slab used by other Buffers in the application.

External Reference:

https://nodejs.org/en/blog/release/v6.2.1/

Upstream patch:

https://github.com/nodejs/node/pull/7051

Comment 2 Adam Mariš 2016-06-07 09:07:50 UTC

Created nodejs tracking bugs for this issue:

Affects: fedora-all [bug 1343395]
Affects: epel-all [bug 1343396]

Comment 5 Jason Shepherd 2018-04-03 04:44:32 UTC

Openshift Enterprise references the latest RHSCL image, which contains 4.6.2. Marking as not affected.
https://github.com/openshift/library/blob/master/official/nodejs/imagestreams/nodejs-rhel7.json