Bug 1810719 (CVE-2020-1751)

Summary:	CVE-2020-1751 glibc: array overflow in backtrace functions for powerpc
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aoliva, apmukher, arjun.is, ashankar, bdettelb, codonell, dj, fweimer, glibc-bugzilla, law, mfabian, mnewsome, pfrankli, rth, security-response-team, siddhesh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	glibc 2.31	Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds write vulnerability was found in glibc when handling signal trampolines on PowerPC. The backtrace function did not properly check the array bounds when storing the frame address resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:24:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1811589, 1813399
Bug Blocks:	1810721

Description Guilherme de Almeida Suckevicz 2020-03-05 19:08:02 UTC

When unwinding through a signal frame the backtrace function on PowerPC didn't check array bounds when storing the frame address.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25423

Upstream commit:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d93769405996dfc11d216ddbe415946617b5a494

Comment 1 Michael Kaplan 2020-03-09 10:01:47 UTC

Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1811589]

Comment 5 Mauro Matteo Cascella 2020-04-17 14:09:50 UTC

Statement:

This flaw did not affect the versions of `glibc` as shipped with Red Hat Enterprise Linux 5, 6, and 7, as they did not include the vulnerable code, which was introduced in a later version of the package.

Comment 6 errata-xmlrpc 2020-11-04 01:00:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4444 https://access.redhat.com/errata/RHSA-2020:4444

Comment 7 Product Security DevOps Team 2020-11-04 02:24:41 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-1751