Bug 1784740 (CVE-2019-19725)

Summary: CVE-2019-19725 sysstat: double free in check_file_actlst() in sa_common.c may lead to arbitrary code execution
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: kasal, kyoshida, mcascell, msekleta
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: sysstat 12.2.1 Doc Type: If docs needed, set a value
Doc Text:
A double-free vulnerability was found in sysstat in the way the `sadf` command processes the contents of data files created by the `sar` command. Saved binary data files with support for `extra_desc` structures may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted file with malformed data that, when loaded by a victim, would cause the application to potentially execute arbitrary code.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-12-27 20:09:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1785293    
Bug Blocks: 1784742    

Description Marian Rehak 2019-12-18 08:50:56 UTC
Sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.

Upstream Issue:

https://github.com/sysstat/sysstat/issues/242

Comment 1 Dave Baker 2019-12-19 15:54:29 UTC
Created sysstat tracking bugs for this issue:

Affects: fedora-all [bug 1785293]

Comment 2 Mauro Matteo Cascella 2019-12-27 11:36:55 UTC
Upstream fix:
https://github.com/sysstat/sysstat/commit/a5c8abd4a481ee6e27a3acf00e6d9b0f023e20ed

Comment 3 Mauro Matteo Cascella 2019-12-27 15:55:54 UTC
The flaw has been introduced upstream in version 12.1.7 with an update to sar/sadf to handle a possible new file format in saved binary data files: 

https://github.com/sysstat/sysstat/commit/44c826602a3d7d899c728bd9e6c3488397c5009f

More specifically, new code has been included in function check_file_actlst() to check if extra structures (`extra_desc`) are present in saved files. In case of malformed data, a previously freed buffer is freed again, leading to a double free vulnerability.

The patch assigns a NULL value to the buffer pointer after the first free(). This implicitly avoids the second free(), which only occurs if the buffer is not NULL.

Comment 4 Mauro Matteo Cascella 2019-12-27 17:42:57 UTC
Statement:

This flaw does not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they do not include support for `extra_desc` structures in binary data files created by the `sar` command. Consequently, they do not include the vulnerable code leading to the double free vulnerability either.

Comment 5 Product Security DevOps Team 2019-12-27 20:09:26 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19725