Bug 1649175
| Summary: | There is a heap-buffer-overflow at slaxlexer.c:1102(funtion:slaxLexer) in libslax latest version that will bring serious impact to Juniper | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | shuitao gan <ganshuitao> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | unspecified | ||||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2018-11-13 14:47:06 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Hello, Red Hat does not ship libslax in any of our supported products. Please, report these issues upstream at: https://github.com/Juniper/libslax Thanks! |
Created attachment 1505093 [details] ./slaxproc --slax-to-xslt POC0 version: libslax latest version (commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) Summary: There is a heap-buffer-overflow at slaxlexer.c:601(funtion:slaxGetInput) in libslax that will will bring serious impact to Juniper. Description: The asan debug is as follows: $./slaxproc --slax-to-xslt POC0 ================================================================= ==123476==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500000e900 at pc 0x7f13757a3e15 bp 0x7fff08d45840 sp 0x7fff08d45830 READ of size 1 at 0x62500000e900 thread T0 #0 0x7f13757a3e14 in slaxLexer ../../libslax/slaxlexer.c:1102 #1 0x7f13757a4e3c in slaxYylex ../../libslax/slaxlexer.c:1267 #2 0x7f13757aefbb in slaxParse /home/company/real_sanitize/libslax-master/build/libslax/slaxparser.c:2447 #3 0x7f13757a881a in slaxLoadFile ../../libslax/slaxloader.c:731 #4 0x406429 in do_slax_to_xslt ../../slaxproc/slaxproc.c:156 #5 0x402c86 in main ../../slaxproc/slaxproc.c:1039 #6 0x7f137499ba3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) #7 0x4041a8 in _start (/home/company/real_sanitize/libslax-master/build/slaxproc/.libs/lt-slaxproc+0x4041a8) 0x62500000e900 is located 0 bytes to the right of 8192-byte region [0x62500000c900,0x62500000e900) allocated by thread T0 here: #0 0x7f1375aafd2a in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98d2a) #1 0x7f13757a1dec in slaxGetInput ../../libslax/slaxlexer.c:601 SUMMARY: AddressSanitizer: heap-buffer-overflow ../../libslax/slaxlexer.c:1102 slaxLexer Shadow bytes around the buggy address: 0x0c4a7fff9cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff9ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff9cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff9d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a7fff9d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c4a7fff9d20:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff9d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff9d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff9d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4a7fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==123476==ABORTING