Bug 1927742

Summary: rpm: integer overflow in hdrblobVerifyRegion()
Product: [Other] Security Response Reporter: msiddiqu
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ffesti, igor.raits, jberan, kaycoth, mdomonko, mjw, packaging-team-maint, pmatilai, pmoravco, security-response-team, tcullum, vmugicag, vmukhame
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A potential integer overflow in hdrblobVerifyRegion() if einfo.offset exceeds SIZE_MAX - REGION_TAG_COUNT. This is only possible on 32-bit systems.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-11 23:25:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1912449, 1929558, 1938095    
Attachments:
Description Flags
Proposed patch provided by Demi M. Obenour. none

Description msiddiqu 2021-02-11 13:09:58 UTC 
 A potential integer overflow in hdrblobVerifyRegion() if einfo.offset exceeds SIZE_MAX - REGION_TAG_COUNT. This is only possible on 32-bit systems.
Comment 1 msiddiqu 2021-02-11 13:10:01 UTC 
Acknowledgments:

Name: Demi M. Obenour
Comment 3 Todd Cullum 2021-02-16 19:28:26 UTC 
Statement:

rpm as shipped in Red Hat Enterprise Linux is not affected by this flaw, as it only applies on 32-bit systems. Only 64-bit is distributed and supported. Please see https://access.redhat.com/solutions/509373 for more information.
Comment 5 Todd Cullum 2021-02-24 00:37:27 UTC 
Created attachment 1758969 [details]
Proposed patch provided by Demi M. Obenour.
Comment 6 Product Security DevOps Team 2021-03-11 23:25:54 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20249