Bug 1665847 (CVE-2019-6250)

Summary: CVE-2019-6250 zeromq: Integer overflow in zmq::v2_decoder_t::size_ready
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abhgupta, dbaker, jokerman, sisharma, sthangav, trankin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: zeromq 4.3.1 Doc Type: If docs needed, set a value
Doc Text:
A pointer overflow flaw was found in ZeroMQ libzmq version 4.2.x and 4.3.x, prior to 4.3.1. An integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer which can be leveraged to run arbitrary code on the target system. This allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-01-16 02:11:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1665849, 1665848    
Bug Blocks: 1665850    

Description Andrej Nemec 2019-01-14 09:20:41 UTC 
A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).

Upstream issue:

https://github.com/zeromq/libzmq/issues/3351

References:

https://github.com/zeromq/libzmq/releases/tag/v4.3.1
Comment 1 Andrej Nemec 2019-01-14 09:21:16 UTC 
Created zeromq tracking bugs for this issue:

Affects: epel-all [bug 1665849]
Affects: fedora-all [bug 1665848]
Comment 3 Eric Christensen 2020-04-24 15:39:30 UTC 
Statement:

This issue does not affect the versions of zeromq3 as shipped with Red Hat Ceph Storage 2 as this version does not contain the code for the version 2 decoder. The zeromq3 version shipped in Red Hat Ceph Storage 2 only contains the version 1 decoder which does not contain affected code.