Bug 1684374 (CVE-2019-9192)

Summary:	CVE-2019-9192 glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	Upstream glibc does not classify this bug as a security issue as per: https://sourceware.org/glibc/wiki/Security%20Exceptions	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-01 08:09:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1684375
Bug Blocks:	1684377

Description Dhananjay Arunesh 2019-03-01 06:20:04 UTC

In the GNU C Library (aka glibc) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796.
NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=24269

Comment 1 Dhananjay Arunesh 2019-03-01 06:20:16 UTC

Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1684375]

Comment 2 Huzaifa S. Sidhpurwala 2019-04-01 08:09:26 UTC

Upstream does not classify this as a security flaw as per:
https://sourceware.org/glibc/wiki/Security%20Exceptions

"Consequently, resource exhaustion issues which can be triggered only with crafted patterns (either during compilation or execution) are not treated as security bugs. (This does not mean we do not intend to fix such issues as regular bugs if possible.) "