Bug 1352459 (CVE-2016-6264)

Summary:	CVE-2016-6264 uClibc: Integer overflow vulnerability leads to code execution on ARM architecture
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dvlasenk, jchaloup, nforro, varekova
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-04 08:29:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1352460
Bug Blocks:

Description Adam Mariš 2016-07-04 08:24:45 UTC

It was found that 'BLT' instruction in libc/string/arm/memset.S checks for signed values. If parameter of memset is negative, then value added to the PC will be large. Attacker that controls the length parameter of memset can also control the value of PC register.

Proposed patch:

http://repo.or.cz/uclibc-ng.git/commit/e3848e3dd64a8d6437531488fe341354bc02eaed

CVE request:

http://seclists.org/oss-sec/2016/q2/621

Comment 1 Adam Mariš 2016-07-04 08:26:38 UTC

Created uClibc tracking bugs for this issue:

Affects: fedora-all [bug 1352460]

Comment 2 Andrej Nemec 2016-07-21 14:19:05 UTC

CVE assignment:

http://seclists.org/oss-sec/2016/q3/126

Comment 3 Fedora Update System 2016-08-27 10:31:09 UTC

uClibc-0.9.33.2-11.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-08-27 15:19:16 UTC

uClibc-0.9.33.2-10.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.