Bug 1402351 (CVE-2016-9843)

Summary:	CVE-2016-9843 zlib: Big-endian out-of-bounds pointer
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	apintea, bbaranow, bkundal, bmaxwell, cdewolf, chazlett, csutherl, dandread, darran.lofthouse, databases-maint, dimitris, dosoudil, fgavrilo, fnasser, gzaronik, huwang, jaromir.capik, jason.greene, jawilson, jboss-set, jchaloup, jclere, jdoyle, jondruse, jshepherd, jvanek, lgao, mbabacek, myarboro, pgier, pjurak, ppalaga, praiskup, psakar, pschiffe, pslavice, rnetuka, rstancel, rsvoboda, sardella, sstavrev, trepik, twalsh, vtunka, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	zlib 1.2.9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-07 10:12:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1402352, 1503325, 1503326, 1503327, 1503328, 1503329, 1503330, 1503331, 1503332, 1503333, 1503334, 1503335, 1503336
Bug Blocks:

Description Andrej Nemec 2016-12-07 10:10:21 UTC

There was a small optimization for PowerPCs to pre-increment a pointer when accessing a word, instead of post-incrementing. This required prefacing the loop with a decrement of the pointer, possibly pointing before the object passed. This is not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined. When tested on a modern PowerPC with a modern compiler, the optimization no longer has any effect.

External References:

https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7

Upstream patch:

https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811

CVE assignment:

http://seclists.org/oss-sec/2016/q4/602

Comment 1 Andrej Nemec 2016-12-07 10:14:24 UTC

Created zlib tracking bugs for this issue:

Affects: fedora-all [bug 1402352]

Comment 2 errata-xmlrpc 2017-05-10 12:46:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1222 https://access.redhat.com/errata/RHSA-2017:1222

Comment 3 errata-xmlrpc 2017-05-10 12:48:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary
  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1221 https://access.redhat.com/errata/RHSA-2017:1221

Comment 4 errata-xmlrpc 2017-05-10 12:50:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary
  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1220 https://access.redhat.com/errata/RHSA-2017:1220

Comment 8 errata-xmlrpc 2017-10-23 07:48:37 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2017:2999 https://access.redhat.com/errata/RHSA-2017:2999

Comment 9 errata-xmlrpc 2017-10-24 12:12:48 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2017:3047 https://access.redhat.com/errata/RHSA-2017:3047

Comment 10 errata-xmlrpc 2017-10-24 12:18:34 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:3046 https://access.redhat.com/errata/RHSA-2017:3046

Comment 11 Doran Moppert 2017-10-31 05:03:41 UTC

Quoting from the report
<https://wiki.mozilla.org/images/0/09/Zlib-report.pdf>:

> We have identified five areas where code in zlib invokes undefined
> behavior in the C standard. Use of this code does not currently
> generate buggy binaries, but it is possible that with future compilers
> or platforms these latent bugs may manifest in compiled code

Using GCC on Red Hat Enterprise Linux supported architectures, the UB
described in this flaw does not manifest as a bug.

Comment 12 errata-xmlrpc 2017-12-13 16:50:22 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 5.8
  Red Hat Satellite 5.8 ELS

Via RHSA-2017:3453 https://access.redhat.com/errata/RHSA-2017:3453