Bug 1620219 (CVE-2018-12115)

Summary:	CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ahardin, akhaitov, athmanem, bleanhar, cbyrne, ccoleman, cmacedo, dedgar, dffrench, drusso, hhorak, jgoulding, jmadigan, jokerman, jorton, jshepherd, lgriffin, mchappel, mrunge, ngough, nodejs-maint, nodejs-sig, piotr1212, pwright, sgallagh, tchollingsworth, thrcka, trepel, trogers, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs 10.9.0, nodejs 8.11.4, nodejs 6.14.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:36:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1621652, 1621654, 1621655, 1621656, 1621657, 1621761, 1621762, 1621763, 1621764, 1621766, 1638279
Bug Blocks:	1620220

Description Pedro Sampaio 2018-08-22 17:47:27 UTC

Node.js TSC member Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR) discovered an OOB write in Buffer that can be used to write to memory outside of a Buffer's memory space. This can corrupt unrelated Buffer objects or cause the Node.js process to crash.

When used with UCS-2 encoding (recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.

Impact:

All previous versions of Node.js 6.x (LTS "Boron") are vulnerable
All previous versions of Node.js 8.x (LTS "Carbon") are vulnerable
All previous versions of Node.js 10.x (Current) are vulnerable

References:

https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

Comment 1 Scott Gayou 2018-08-22 20:50:15 UTC

Upstream Fix:

https://github.com/nodejs/node/commit/fc14d812b7

Comment 2 errata-xmlrpc 2018-08-22 21:12:44 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Application Runtimes Node.js 8

Via RHSA-2018:2552 https://access.redhat.com/errata/RHSA-2018:2552

Comment 3 errata-xmlrpc 2018-08-22 21:14:32 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Application Runtimes Node.js 10

Via RHSA-2018:2553 https://access.redhat.com/errata/RHSA-2018:2553

Comment 4 Scott Gayou 2018-08-23 17:13:14 UTC

All versions impacted. nodejs advisory doesn't mention 4.x, which also segfaults. Guessing because node 4 is end of lifed.

Comment 6 Scott Gayou 2018-08-23 17:28:06 UTC

Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 1621655]
Affects: fedora-all [bug 1621656]

Comment 13 Jason Shepherd 2018-08-28 02:32:31 UTC

Mitigation:

On Openshift Container Platform 3.x you can override the container image used on the Jenkins Slave by specifying the JENKINS_SLAVE_IMAGE environment variable in your jenkins deployment configuration. Ref:

https://github.com/openshift/jenkins/blob/8e1ab16fb5f44d6570018c5dfa3407692fdba6e5/2/contrib/jenkins/kube-slave-common.sh#L27-L33

Comment 14 Jason Shepherd 2018-08-28 06:14:38 UTC

The logging-kibana component of Openshift Container Platform 3.x does't write to any Buffers, so is not affected by this vulnerability.

Comment 15 Jason Shepherd 2018-08-29 08:01:18 UTC

The logging-auth-proxy component of Openshift Container Platform 3.x uses NodeJS 0.10 which is not affected by this issue.

Comment 16 Jason Shepherd 2018-08-30 04:01:22 UTC

Comment 20 Tomas Hoger 2018-09-10 14:29:31 UTC

Fixed upstream in Node.js 6.14.4, 8.11.4, and 10.9.0:

https://nodejs.org/en/blog/release/v6.14.4/
https://nodejs.org/en/blog/release/v8.11.4/
https://nodejs.org/en/blog/release/v10.9.0/

Comment 23 errata-xmlrpc 2018-10-18 07:44:18 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2018:2944 https://access.redhat.com/errata/RHSA-2018:2944

Comment 24 errata-xmlrpc 2018-10-18 10:10:35 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2018:2949 https://access.redhat.com/errata/RHSA-2018:2949

Comment 25 errata-xmlrpc 2018-12-03 17:28:10 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2018:3537 https://access.redhat.com/errata/RHSA-2018:3537

Comment 26 Sam Fowler 2019-07-17 03:25:22 UTC

Statement:

Openshift Container Platform 3.x versions are potentially vulnerable via the jenkins-slave-nodejs and jenkins-agent-nodejs containers. However a build would have to occur with a malicious jenkins pipeline, or nodejs source code supplied by an attacker, reducing the impact of this flaw to moderate. Both container images used nodejs delivered from Red Hat Software Collections.