Bug 1478373 (CVE-2017-7555)

Summary:	CVE-2017-7555 augeas: Improper handling of escaped strings leading to memory corruption
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aortega, apevec, apevec, chrisw, cvsbot-xmlrpc, dblechte, dcleal, dfediuck, dmoppert, dominic, dougsland, eedri, jjoyce, jschluet, kbasil, lhh, lpeer, lutter, markmc, mgoldboi, michal.skrivanek, ptoscano, rbalakri, rbryant, rhos-maint, sbonazzo, sclewis, security-response-team, sherold, sisharma, smohan, srevivo, ssaha, tdecacqu, vbellur, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	augeas 1.8.1	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was discovered in augeas affecting the handling of escaped strings. An attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-26 00:21:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1475621, 1481545, 1481546, 1482340, 1483825, 1483826, 1483913, 1724856
Bug Blocks:	1478377

Description Adam Mariš 2017-08-04 13:07:59 UTC

It was found that augeas does incorrect escaping in aug_escape_name() function causing denial-of-service.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1475621

Comment 1 Adam Mariš 2017-08-04 13:08:09 UTC

Acknowledgments:

Name: Han Han (Red Hat)

Comment 2 Doran Moppert 2017-08-10 07:33:34 UTC

Upstream patch:

https://github.com/hercules-team/augeas/pull/480

Comment 7 Doran Moppert 2017-08-17 04:50:40 UTC

Since the patch is already public, going for immediate disclosure on this.  Rated as Important due to exposure in libvirtd.

The above patch includes good test coverage, so no further test/repro is required for QE.

Comment 8 Doran Moppert 2017-08-17 04:51:18 UTC

Created augeas tracking bugs for this issue:

Affects: fedora-all [bug 1482340]

Comment 9 Doran Moppert 2017-08-18 02:30:50 UTC

Upstream release 1.8.1 contains the fix for this issue:

https://github.com/hercules-team/augeas/releases/tag/release-1.8.1

Tarball available from:

http://download.augeas.net/

Comment 13 errata-xmlrpc 2017-09-21 11:37:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2788 https://access.redhat.com/errata/RHSA-2017:2788

Comment 15 errata-xmlrpc 2019-08-07 11:36:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.3 Telco Extended Update Support

Via RHSA-2019:2403 https://access.redhat.com/errata/RHSA-2019:2403