Bug 1565468 (CVE-2018-9838)

Summary:	CVE-2018-9838 ocaml: Integer overflow in byterun/bigarray.c:caml_ba_deserialize() allows remote attackers to cause a denial of service or other unspecified impact
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	c.david86, gemi, rjones, sfowler
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 20:00:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1565470, 1565471, 1566999
Bug Blocks:	1565476

Description Sam Fowler 2018-04-10 05:20:22 UTC

The OCaml standard library in version 4.06.00 has an integer overflow vulnerability in byterun/bigarray.c:caml_ba_deserialize() when handling serialized (marshalled) data. A remote attacker could exploit this to cause a denial of service or possible code execution by supplying a crafted serialized object.


Upstream Issue:

https://caml.inria.fr/mantis/view.php?id=7765

Comment 1 Sam Fowler 2018-04-10 05:22:24 UTC

Created ocaml tracking bugs for this issue:

Affects: fedora-all [bug 1565471]

Comment 5 Richard W.M. Jones 2018-04-10 07:04:23 UTC

I think the impact of this should be "low".

My reasoning is that the Marshal interface is unsafe and should not
be used when sending data to untrusted end points.  The documentation
is quite explicit about this.

It is possible to crash the remote end point in multiple ways, eg:

let m = Marshal.to_string (1, 2) []
let x : bool * string = Marshal.from_string m 0
let () = Printf.printf "%b * %s" (fst x) (snd x)

$ ocamlopt crash.ml -o crash
$ ./crash 
Segmentation fault (core dumped)

OCaml provides ways to serialize data safely but Marshal is a low-level
interface which doesn't do that.

Of course I will fix this problem anyway in Fedora & RHEL.

Comment 6 Richard W.M. Jones 2018-04-11 11:57:02 UTC

They're still working on a fix upstream, but the latest proposal is
https://github.com/ocaml/ocaml/pull/1718