Bug 1555064 (CVE-2018-1000127)

Summary:	CVE-2018-1000127 memcached: Integer Overflow in items.c:item_free()
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, chrisw, dffrench, drusso, hguemar, jjoyce, jmadigan, jorton, jschluet, jshepherd, kbasil, lgriffin, lhh, lindner, lpeer, markmc, matthias, mburns, mlichvar, ngough, pwright, rbryant, rrajasek, rschiron, sclewis, slinaber, tdecacqu, trepel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	memcached 1.4.37	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:17:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1555065, 1557093, 1557286, 1557287, 1557646, 1557647, 1557648, 1557649
Bug Blocks:	1555067

Description Laura Pardo 2018-03-13 22:05:27 UTC

A flaw was found in memcached version prior to 1.4.37. It contains an Integer
Overflow vulnerability in items.c:item_free() that can result in resource leaks
or data corruption, deadlocks and crashes due to items existing in hash table
being reused from free list. This attack appear to be exploitable via network
connectivity to the memcached service.


References:
https://github.com/memcached/memcached/issues/271
https://github.com/memcached/memcached/wiki/ReleaseNotes1437

Upstream Patch:
https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00

Comment 1 Laura Pardo 2018-03-13 22:06:26 UTC

Created memcached tracking bugs for this issue:

Affects: openstack-rdo [bug 1555065]

Comment 4 Riccardo Schirone 2018-03-16 11:40:38 UTC

RHEL 6 is affected by this flaw, being subject to the integer overflow in items.c:item_free(), but items are not put back in the freelist if they are still used. However, it can cause memory leaks and, potentially, resource exhaustion.

Comment 7 errata-xmlrpc 2018-07-30 17:41:41 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2018:2290 https://access.redhat.com/errata/RHSA-2018:2290