Bug 1449629 (CVE-2017-8399)

Summary:	CVE-2017-8399 pcre2: Stack-based buffer overflow in pcre2_match.c
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adam.stokes, andrew, csutherl, databases-maint, erik-fedora, fedora-mingw, fedora, fidencio, gzaronik, hhorak, jclere, jdoyle, jgrulich, jorton, klember, lgao, lkundrak, marcandre.lureau, mbabacek, mclasen, mmuzila, mschorm, myarboro, pmyers, ppisar, pslavice, rcollet, rjones, rsvoboda, sardella, twalsh, walters, webstack-team, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:12:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1449630, 1449631
Bug Blocks:

Description Adam Mariš 2017-05-10 11:43:39 UTC

PCRE2 before 2017-03-10 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures."

Bug report:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=783

Upstream patch:

https://vcs.pcre.org/pcre2?view=revision&revision=674

Comment 1 Adam Mariš 2017-05-10 11:44:15 UTC

Created pcre2 tracking bugs for this issue:

Affects: epel-all [bug 1449630]
Affects: fedora-all [bug 1449631]

Comment 2 Petr Pisar 2017-05-10 12:43:25 UTC

Are you sure this the right commit? The r674 commit is from 2017-03-22. I also enabled the fuzzer support but running ./pcre2test with the linked reproducer does not show any crashes or abortions.

Comment 3 Petr Pisar 2017-05-10 12:45:31 UTC

(In reply to Petr Pisar from comment #2)
> Are you sure this the right commit? The r674 commit is from 2017-03-22.

I see. It's about unreleased code. Ignore my question.