Bug 1810670 (CVE-2020-10029)
| Summary: | CVE-2020-10029 glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aoliva, apmukher, arjun.is, ashankar, awestbro, bdettelb, cmoore, codonell, dj, fcanogab, fweimer, glibc-bugzilla, gmccullo, huzaifas, kaycoth, law, lmorse, mbenatto, mfabian, mmezynsk, mmilgram, mnewsome, pfrankli, rth, sdunning, siddhesh, tcrider |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 02:24:36 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1810671, 1811796, 1812119, 1890405, 1890406, 1890407, 1890408, 1890409, 1890410, 1890871, 1980890, 1980891 | ||
| Bug Blocks: | 1810673 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-03-05 17:29:22 UTC
Created glibc tracking bugs for this issue: Affects: fedora-all [bug 1810671] There's an issue in __ieee754_rem_pio2l() function, where it doesn't validate correctly pseudo-zero values before call __kernel_rem_pio2() which doesn't expect such values. The __ieee754_rem_pio2l() is used by sinl() function and an attacker may take advantage by crafting an malicious input which may trigger stack corruption, compromising data integrity or confidentiality, DoS or code execution in some scenarios. The glibc version shipped with Red Hat Enterprise Linux 8 is compiled using the stack-protector feature which mitigates code execution possibility. We outstanding issues CVE-2020-10029 and CVE-2020-1752, but there is no new errata for these. Do you all have an ETA for the glibc fix for RHEL 8? A note on analysis: After running the code through gdb on rhel-7, i doubt the exploitibilty of this flaw. Just before it crashes in __ieee754_rem_pio2l(), i can see that the EIP is replaced with 0x0000000000000000 220 n = __kernel_rem_pio2 (tx, ty, exp, 3, 2, two_over_pi); (gdb) 218 tx[2] = (double) ((i1 << 8) & 0xffffff); (gdb) 220 n = __kernel_rem_pio2 (tx, ty, exp, 3, 2, two_over_pi); (gdb) Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) So because of the pseudo zero values used, i think all the attacker can do is overwrite the stack with 0's, which means that a reachable jump address for code execution is difficult to get and may result in only a crash. Statement: The glibc version shipped with Red Hat Enterprise Linux 8 is compiled using gcc's stack-protector option which mitigates the possibility of code execution led by the stack corruption. The glibc version shipped with Red Hat Enterprise Linux 7 is more difficult to exploit using this flaw, specifically for remote code execution. Because exploitation of the flaw depends on the usage of pseudo-zero values, an attacker can only overwrite the stack with 0s. Due to this, a valid address value for code execution is difficult to get and is likely to only result in a crash. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4444 https://access.redhat.com/errata/RHSA-2020:4444 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10029 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:0348 https://access.redhat.com/errata/RHSA-2021:0348 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2021:2998 https://access.redhat.com/errata/RHSA-2021:2998 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Advanced Update Support Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Red Hat Enterprise Linux 7.6 Telco Extended Update Support Via RHSA-2021:3315 https://access.redhat.com/errata/RHSA-2021:3315 |