Bug 1622242 (CVE-2018-1000221)

Summary:	CVE-2018-1000221 pkgconf: 1 byte out of bounds read for 0 length keys
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	igor.raits, ngompa13, rhughes
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pkgconf 1.5.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-08-25 21:16:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1696297

Description Pedro Sampaio 2018-08-24 21:14:46 UTC

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.

Upstream patch:

https://git.dereferenced.org/pkgconf/pkgconf/pulls/3

Comment 1 Neal Gompa 2018-08-25 19:42:48 UTC

pkgconf 1.5.3 has been in Fedora 29/Rawhide since the end of July: https://koji.fedoraproject.org/koji/buildinfo?buildID=1132595

Comment 2 Stefan Cornelius 2019-04-17 14:40:12 UTC

Probably introduced via https://git.dereferenced.org/pkgconf/pkgconf/commit/b46bb93cd1fe221dc4d6ff5e3ce99feda4ea31f1