Bug 1799734 (CVE-2019-20388)

Summary:	CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amackenz, amasferr, c.david86, chazlett, csutherl, dking, drieden, erik-fedora, gzaronik, igor.raits, jclere, jwon, krathod, ktietz, mbabacek, mkudlej, mturk, ohudlick, pjindal, rh-spice-bugs, rjones, tjochec, tvainio, veillard
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-22 17:20:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1799736, 1799738, 1799739, 1810057, 1810058, 1810059, 1921208, 1921209, 1921210
Bug Blocks:	1799791, 1997390

Description Guilherme de Almeida Suckevicz 2020-02-06 18:50:25 UTC

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Reference and upstream commit:
https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68

Comment 1 Guilherme de Almeida Suckevicz 2020-02-06 18:50:57 UTC

Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1799736]


Created mingw-libxml2 tracking bugs for this issue:

Affects: epel-7 [bug 1799739]
Affects: fedora-all [bug 1799738]

Comment 4 Riccardo Schirone 2020-03-04 13:34:07 UTC

Function xmlSchemaValidateStream() in xmlschemas.c calls xmlSchemaSAXPlug(), which calls xmlSchemaPreRun().
xmlSchemaPreRun() sets `vctxt->xsiAssemble = 0;`, then if vctxt->schema is NULL it sets `vctxt->xsiAssemble = 1;` and it allocates a new schema, storing the pointer in vctxt->schema. 

Function xmlSchemaPostRun() is supposed to free the schema, but it does so only if vctxt->xsiAssemble's value is not 0. This is not the case sometimes, because function xmlSchemaValidateStream(), after having called xmlSchemaSAXPlug(), also calls xmlSchemaVStart() which calls again xmlSchemaPreRun(). As said, this last function initially sets `vctxt->xsiAssemble = 0;`, thus preventing the code to free the previously allocated schema.

Comment 7 errata-xmlrpc 2020-06-22 12:26:43 UTC

This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6
  JBoss Core Services on RHEL 7

Via RHSA-2020:2644 https://access.redhat.com/errata/RHSA-2020:2644

Comment 8 errata-xmlrpc 2020-06-22 13:08:47 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2020:2646 https://access.redhat.com/errata/RHSA-2020:2646

Comment 9 Product Security DevOps Team 2020-06-22 17:20:34 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20388

Comment 10 errata-xmlrpc 2020-09-29 20:27:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3996 https://access.redhat.com/errata/RHSA-2020:3996

Comment 11 errata-xmlrpc 2020-11-04 01:21:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4479 https://access.redhat.com/errata/RHSA-2020:4479