Bug 1885775 (CVE-1999-0199)

Summary:	CVE-1999-0199 glibc: manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aoliva, ashankar, bdettelb, codonell, dj, fweimer, glibc-bugzilla, kmullins, law, mfabian, mnewsome, pfrankli, rth, sipoyare, tomckay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-21 14:21:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1885776

Description Guilherme de Almeida Suckevicz 2020-10-06 21:20:08 UTC

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

Reference:
https://www.cee.studio/tdelete.html

Upstream patch:
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=2864e767053317538feafa815046fff89e5a16be#patch3

Comment 4 Todd Cullum 2020-10-08 22:08:18 UTC

Statement:

Red Hat Product Security does not feel that this issue has any security impact because the CVE description suggests that a missing statement in the manpage could lead to a generalized developer awareness problem, that in turn could potentially lead to a flaw. Thus, there is no actual exploitable vulnerability reported in this CVE, but rather, the possibility that one could occur in some *unspecified* software which uses glibc where the developers haven't read the manpage since 1999. There is no direct way for a vulnerability to come to fruition in software based solely on developer knowledge (or lack thereof), but an *implementation* of that knowledge, which is absent from the description of this issue.

This manpage issue does not affect glibc as shipped with Red Hat Enterprise Linux 5, 6, 7, or 8 as the versions of glibc shipped already have the updated manpage.

Comment 5 Product Security DevOps Team 2020-10-21 14:21:14 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-1999-0199