Bug 1668005 (CVE-2019-3817)

Summary:	CVE-2019-3817 libcomps: use after free when merging two objmrtrees
Product:	[Other] Security Response	Reporter:	Riccardo Schirone <rschiron>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dmach, jluza, jmracek, jrohel, mblaha, packaging-team-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libcomps 0.1.10	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw has been discovered in libcomps in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-06 00:51:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1668680, 1668681, 1668683, 1668684
Bug Blocks:	1668006

Description Riccardo Schirone 2019-01-21 16:53:44 UTC

There is a use-after-free in libcomps library in comps_objmradix.c:comps_objmrtree_unite() function. When two ObjMRTrees are merged, pair variable may be freed and accessed again at the next iteration. An attacker who is able to craft a malicious comps XML file may use this flaw to crash the application or potentially execute code.

Upstream issue:
https://github.com/rpm-software-management/libcomps/issues/41

Comment 1 Riccardo Schirone 2019-01-21 16:53:46 UTC

Acknowledgments:

Name: Riccardo Schirone (Red Hat Product Security)

Comment 2 Riccardo Schirone 2019-01-21 17:04:50 UTC

libcomps library is mainly used by dnf and koji.

Comment 3 Riccardo Schirone 2019-01-22 09:56:45 UTC

ObjMRTree object type is used to implement the MDict type, which is used to store the "blacklist" and the "whiteout" parts of a comps XML file. However, when merging two Doc objects, blacklist and whiteout are not merged, thus code that do not directly use MDict (e.g. dnf and koji) cannot trigger the flaw.

Comment 4 Riccardo Schirone 2019-01-22 11:58:55 UTC

Upstream patch:
https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046

Comment 6 Riccardo Schirone 2019-01-23 10:30:30 UTC

Created libcomps tracking bugs for this issue:

Affects: epel-7 [bug 1668681]
Affects: fedora-all [bug 1668680]

Comment 9 Jaroslav Rohel 2019-04-04 07:30:10 UTC

Upstream patch https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046 was merged.
Fixed in libcomps version 0.1.10

Comment 10 errata-xmlrpc 2019-11-05 21:15:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3583 https://access.redhat.com/errata/RHSA-2019:3583

Comment 11 Product Security DevOps Team 2019-11-06 00:51:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-3817

Comment 12 errata-xmlrpc 2019-11-18 13:02:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2019:3898 https://access.redhat.com/errata/RHSA-2019:3898