Bug 1464920 (CVE-2017-9772)

Summary: CVE-2017-9772 ocaml: Insufficient sanitisation allows privilege escalation for setuid binaries
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: c.david86, rjones
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ocaml 4.04.2 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:15:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1464921    
Bug Blocks:    

Description Andrej Nemec 2017-06-26 08:57:44 UTC
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

External References:

https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html

Upstream issue:

https://caml.inria.fr/mantis/view.php?id=7557

Comment 1 Andrej Nemec 2017-06-26 08:58:34 UTC
Created ocaml tracking bugs for this issue:

Affects: fedora-rawhide [bug 1464921]

Comment 2 Richard W.M. Jones 2017-06-26 09:16:32 UTC
Affects Fedora 26 (OCaml 4.04.0) as well.