Bug 1929847 (CVE-2021-27218)

Summary: CVE-2021-27218 glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: caillon+fedoraproject, erack, erik-fedora, fedora, fidencio, gnome-sig, jhorak, kaycoth, klember, manisandro, marcandre.lureau, mcatanza, mclasen, mdean, nobody, pahan, paul, rdieter, rhel8-maint, rh-spice-bugs, rhughes, rjones, rstrode, sandmann, stransky, tiagomatos, tpopela, walters
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: glib 2.66.7, glib 2.67.4 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-08-10 13:28:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1941698, 1941699, 1941700, 1929848, 1929849, 1929850, 1929851, 1939072, 1939073, 1939074, 1939075, 1939076, 1941679, 1941680, 1941681, 1941682, 1941684, 1941685, 1941701, 1974886, 1974887, 1974888    
Bug Blocks: 1929863    

Description Guilherme de Almeida Suckevicz 2021-02-17 19:00:18 UTC
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.


Comment 1 Guilherme de Almeida Suckevicz 2021-02-17 19:00:52 UTC
Created glib tracking bugs for this issue:

Affects: epel-7 [bug 1929851]
Affects: fedora-all [bug 1929848]

Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1929849]

Created mingw-glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1929850]

Comment 5 Riccardo Schirone 2021-05-13 15:41:15 UTC
This issue is about an integer truncation that occurs only when an application uses g_byte_array_new_take (or inderectly uses it, like with g_bytes_unref_to_array), provides a way for an attacker to provide both size and data and that could lead to at most an impact on the availability of the application/service. Moreover, if the application correctly uses the array->len field to determine the size of the GBytesArray, where array is the GBytesArray returned by g_byte_array_new_take/g_bytes_unref_to_array, no other direct security problem could happen because the stored length is less than what initially was. For these reason, this flaw got a Moderate Impact.

Comment 10 errata-xmlrpc 2021-08-10 13:15:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3058 https://access.redhat.com/errata/RHSA-2021:3058

Comment 11 Product Security DevOps Team 2021-08-10 13:28:11 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 12 errata-xmlrpc 2021-11-09 19:06:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4526 https://access.redhat.com/errata/RHSA-2021:4526