Bug 1820331 (CVE-2020-6096)

Summary: CVE-2020-6096 glibc: signed comparison vulnerability in the ARMv7 memcpy function
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aoliva, arjun.is, ashankar, bdettelb, codonell, dj, fweimer, glibc-bugzilla, jschorr, law, mfabian, mnewsome, pfrankli, rth, siddhesh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: glibc 2.32 Doc Type: If docs needed, set a value
Doc Text:
A signed comparison vulnerability was found in GNU libc in the ARMv7 implementation of memcpy(). The flaw affects the third argument to memcpy() that specifies the number of bytes to copy. An underflow on the third argument could lead to undefined behavior such as out-of-bounds memory write and potentially remote code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-16 16:32:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1820332    
Bug Blocks: 1820333    

Description Guilherme de Almeida Suckevicz 2020-04-02 18:37:20 UTC 
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=25620
Comment 1 Guilherme de Almeida Suckevicz 2020-04-02 18:38:15 UTC 
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1820332]
Comment 5 Product Security DevOps Team 2020-04-16 16:32:18 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-6096
Comment 6 Mauro Matteo Cascella 2020-04-16 16:42:13 UTC 
Statement:

Red Hat Enterprise Linux only supports the 64-bit ARM architecture (AArch64) which does not include the vulnerable implementation of `memcpy()`. Therefore, all versions of glibc as shipped with RHEL are not affected by this flaw.
Comment 8 Mauro Matteo Cascella 2020-04-17 13:05:56 UTC 
External References:

https://sourceware.org/bugzilla/attachment.cgi?id=12334
Comment 9 Mauro Matteo Cascella 2020-08-03 14:43:52 UTC 
Upstream fix:
https://sourceware.org/git/?p=glibc.git;a=commit;h=79a4fa341b8a89cb03f84564fd72abaa1a2db394
https://sourceware.org/git/?p=glibc.git;a=commit;h=beea361050728138b82c57dda0c4810402d342b9