Bug 1927740 (CVE-2021-20248)

Summary: CVE-2021-20248 rpm: integer overflow in hdrblobVerifyRegion() in lib/header.c
Product: [Other] Security Response Reporter: msiddiqu
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: demiobenour, ffesti, igor.raits, jberan, kaycoth, mdomonko, mjw, packaging-team-maint, pmatilai, pmoravco, security-response-team, tcullum, vmugicag, vmukhame
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An integer overflow flaw was found in rpm which can allow undefined behavior. The highest threat from this vulnerability is to data confidentiality, availability and integrity.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-11 23:25:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1912449, 1929557, 1938103    
Attachments:
Description Flags
proprosed patch none

Description msiddiqu 2021-02-11 13:09:17 UTC
Integer overflow in hdrblobVerifyRegion(), if einfo.offset (from the trailer) is INT32_MIN, negating it will overflow, which is undefined behavior.

Comment 1 msiddiqu 2021-02-11 13:09:21 UTC
Acknowledgments:

Name: Demi M. Obenour

Comment 3 Todd Cullum 2021-02-13 01:36:38 UTC
Created attachment 1756741 [details]
proprosed patch

Comment 4 Todd Cullum 2021-02-13 01:37:29 UTC
^ Proposed patch from Demi M. Obenour

Comment 5 Todd Cullum 2021-02-16 19:28:11 UTC
Statement:

rpm as shipped in Red Hat Enterprise Linux is not affected by this flaw, as it only applies on 32-bit systems. Only 64-bit is distributed and supported. Please see https://access.redhat.com/solutions/509373 for more information.

Comment 7 Product Security DevOps Team 2021-03-11 23:25:49 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20248

Comment 8 Demi Marie Obenour 2021-03-16 22:45:44 UTC
(In reply to Todd Cullum from comment #5)
> Statement:
> 
> rpm as shipped in Red Hat Enterprise Linux is not affected by this flaw, as
> it only applies on 32-bit systems. Only 64-bit is distributed and supported.
> Please see https://access.redhat.com/solutions/509373 for more information.

64-bit systems are also affected; see the attached package.  Git HEAD has already been patched.