Bug 1575536 (CVE-2018-1000301)

Summary: CVE-2018-1000301 curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bgollahe, bodavis, csutherl, dbhole, gzaronik, hhorak, jclere, john.j5live, jorton, kanderso, kdudka, lgao, luhliari, lzachar, mbabacek, myarboro, omajid, paul, rwagner, security-response-team, twalsh, weli, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: curl 7.60.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:21:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1576996, 1577001, 1578682, 1578683, 1802796, 1802797    
Bug Blocks: 1575537    
Attachments:
Description Flags
Upstream patch none

Description Adam Mariš 2018-05-07 08:37:41 UTC 
curl can be tricked into reading data beyond the end of a heap based buffer
used to store downloaded content.

When servers send RTSP responses back to curl, the data starts out with a set
of headers. curl parses that data to separate it into a number of headers to
deal with those appropriately and to find the end of the headers that signal
the start of the "body" part.

The function that splits up the response into headers is called
`Curl_http_readwrite_headers()` and in situations where it can't find a single
header in the buffer, it might end up leaving a pointer pointing into the
buffer instead of to the start of the buffer which then later on may lead to
an out of buffer read when code assumes that pointer points to a full buffer
size worth of memory to use.

This could potentially lead to information leakage but most likely a
crash/denial of service for applications if a server triggers this flaw.

Introduced by following patches:

https://github.com/curl/curl/commit/b2ef79ef3d47b37
https://github.com/curl/curl/commit/bc4582b68a673d3

Affected versions: curl 7.20.0 to and including curl 7.59.0
Not affected versions: curl < 7.20.0 and curl >= 7.60.0
Comment 2 Adam Mariš 2018-05-07 08:45:18 UTC 
Created attachment 1432530 [details]
Upstream patch
Comment 3 Adam Mariš 2018-05-07 08:53:00 UTC 
Acknowledgments:

Name: the Curl project
Upstream: the OSS-Fuzz project
Comment 6 Adam Mariš 2018-05-16 07:25:58 UTC 
External References:

https://curl.haxx.se/docs/adv_2018-b138.html
Comment 7 Adam Mariš 2018-05-16 07:27:35 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1578683]
Comment 9 errata-xmlrpc 2018-10-30 07:43:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3157 https://access.redhat.com/errata/RHSA-2018:3157
Comment 10 errata-xmlrpc 2018-11-13 08:36:28 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558
Comment 12 errata-xmlrpc 2020-02-18 14:44:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2020:0544 https://access.redhat.com/errata/RHSA-2020:0544
Comment 13 errata-xmlrpc 2020-02-25 12:11:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:0594 https://access.redhat.com/errata/RHSA-2020:0594