Bug 1927062 (CVE-2021-26937)

Summary:	CVE-2021-26937 screen: crash when processing combining chars
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ben.morrice, jridky, lnykryn, ovasik, pasteur, phracek, ponikam, psampaio, skontar, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in screen. A specially crafted sequence of combining characters could cause an out of bounds write leading to arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-08 13:01:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1927063, 1927064, 1927065, 1927066, 2048282
Bug Blocks:	1927067

Description Doran Moppert 2021-02-10 00:33:43 UTC

A crash was reported in gnu screen when processing a specially crafted sequence of combining characters.  The cause is an out of bounds write, which may be exploitable to cause arbitrary code execution.

https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
https://www.openwall.com/lists/oss-security/2021/02/09/3

Upstream bug:

https://savannah.gnu.org/bugs/?60030

Comment 1 Doran Moppert 2021-02-10 00:37:44 UTC

Created gnome-screensaver tracking bugs for this issue:

Affects: fedora-all [bug 1927066]

Comment 3 Pedro Sampaio 2021-02-10 12:23:58 UTC

*** Bug 1926949 has been marked as a duplicate of this bug. ***

Comment 4 Doran Moppert 2021-02-11 01:18:16 UTC

Mitigation:

This flaw is in utf8 processing; if your screen configuration does not enable utf8 (through configuration such as "defencoding utf-8" in .screenrc), you are not vulnerable.

Comment 9 errata-xmlrpc 2021-03-08 10:30:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0742 https://access.redhat.com/errata/RHSA-2021:0742

Comment 10 Product Security DevOps Team 2021-03-08 13:01:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-26937

Comment 12 errata-xmlrpc 2022-03-28 10:30:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support

Via RHSA-2022:1074 https://access.redhat.com/errata/RHSA-2022:1074