Bug 1784740 (CVE-2019-19725)
| Summary: | CVE-2019-19725 sysstat: double free in check_file_actlst() in sa_common.c may lead to arbitrary code execution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | kasal, kyoshida, mcascell, msekleta |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | sysstat 12.2.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A double-free vulnerability was found in sysstat in the way the `sadf` command processes the contents of data files created by the `sar` command. Saved binary data files with support for `extra_desc` structures may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted file with malformed data that, when loaded by a victim, would cause the application to potentially execute arbitrary code.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-12-27 20:09:26 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1785293 | ||
| Bug Blocks: | 1784742 | ||
|
Description
Marian Rehak
2019-12-18 08:50:56 UTC
Created sysstat tracking bugs for this issue: Affects: fedora-all [bug 1785293] The flaw has been introduced upstream in version 12.1.7 with an update to sar/sadf to handle a possible new file format in saved binary data files: https://github.com/sysstat/sysstat/commit/44c826602a3d7d899c728bd9e6c3488397c5009f More specifically, new code has been included in function check_file_actlst() to check if extra structures (`extra_desc`) are present in saved files. In case of malformed data, a previously freed buffer is freed again, leading to a double free vulnerability. The patch assigns a NULL value to the buffer pointer after the first free(). This implicitly avoids the second free(), which only occurs if the buffer is not NULL. Statement: This flaw does not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they do not include support for `extra_desc` structures in binary data files created by the `sar` command. Consequently, they do not include the vulnerable code leading to the double free vulnerability either. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-19725 |