Bug 1446063 (CVE-2017-8291)

Summary:	CVE-2017-8291 ghostscript: corruption of operand stack
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abhgupta, cbuissar, deekej, kseifried, slawomir, tiwillia, twaugh, yozone, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-05-12 11:51:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1446064, 1447220, 1447221, 1447222, 1447223
Bug Blocks:	1445360, 1446066

Description Adam Mariš 2017-04-27 08:03:21 UTC

It was reported that Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program.

Upstream issue:

https://bugs.ghostscript.com/show_bug.cgi?id=697808

Comment 1 Adam Mariš 2017-04-27 08:03:53 UTC

Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 1446064]

Comment 2 Andrej Nemec 2017-04-28 08:15:16 UTC

[Updated] Upstream patches:

https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce1
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac

Comment 3 Cedric Buissart 2017-04-28 12:46:45 UTC

This is a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1445359

Comment 4 Cedric Buissart 2017-04-28 14:51:43 UTC

*** Bug 1445359 has been marked as a duplicate of this bug. ***

Comment 9 Cedric Buissart 2017-05-03 14:56:20 UTC

Note:
The original patch has a regression in some rare conditions (when using the "DELAYBIND" feature). In such situation, the additional patch is required :
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719

Comment 10 Cedric Buissart 2017-05-11 13:21:34 UTC

It appears that the additional patch in comment 9 has its own regression.

Comment 11 Cedric Buissart 2017-05-11 13:52:43 UTC

One more patch :
* Bug 697892: fix check for op stack underflow.
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac

Comment 12 errata-xmlrpc 2017-05-12 10:20:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1230 https://access.redhat.com/errata/RHSA-2017:1230