Bug 1566788 (CVE-2018-9996)

Summary:	CVE-2018-9996 binutils: Stack-overflow in libiberty/cplus-dem.c causes crash
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aoliva, dvlasenk, erik-fedora, jakub, klember, ktietz, law, nickc, ohudlick, rjones, yselkowi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-05-17 22:47:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1564294, 1566789, 1566790, 1566791, 1566792
Bug Blocks:	1564296

Description Sam Fowler 2018-04-13 01:52:43 UTC

GNU Binutils through version 2.30 is vulnerable to a stack-overflow in the libiberty/cplus-dem.c demangling functions demangle_template_value_parm, demangle_integral_value, and demangle_expression. An attacker could exploit this to cause a crash via a crafted file.


Upstream Bug:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85304

Comment 1 Sam Fowler 2018-04-13 01:53:16 UTC

Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1566792]


Created mingw-binutils tracking bugs for this issue:

Affects: fedora-all [bug 1566790]
Affects: epel-all [bug 1566789]

Comment 4 Pedro Yóssis Silva Barbosa 2018-05-17 22:47:08 UTC

Tested in RHEL 7 and 6 but c++filt didn't crash with the provided PoC. It may be because without sanitizer it is necessary less stack per recursion level. In any case, as stated by upstream, it seems that all is working as designed and isn't a bug.

Comment 5 Doran Moppert 2020-02-11 00:30:31 UTC

Statement:

Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details.