Bug 1929847 (CVE-2021-27218)

Summary:	CVE-2021-27218 glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caillon+fedoraproject, erack, erik-fedora, fedora, fidencio, gnome-sig, jhorak, kaycoth, klember, manisandro, marcandre.lureau, mcatanza, mclasen, mdean, nobody, pahan, paul, rdieter, rhel8-maint, rh-spice-bugs, rhughes, rjones, rstrode, sandmann, stransky, tiagomatos, tpopela, walters
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	glib 2.66.7, glib 2.67.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-08-10 13:28:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1941698, 1941699, 1941700, 1929848, 1929849, 1929850, 1929851, 1939072, 1939073, 1939074, 1939075, 1939076, 1941679, 1941680, 1941681, 1941682, 1941684, 1941685, 1941701, 1974886, 1974887, 1974888
Bug Blocks:	1929863

Description Guilherme de Almeida Suckevicz 2021-02-17 19:00:18 UTC

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

References:
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944

Comment 1 Guilherme de Almeida Suckevicz 2021-02-17 19:00:52 UTC

Created glib tracking bugs for this issue:

Affects: epel-7 [bug 1929851]
Affects: fedora-all [bug 1929848]


Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1929849]


Created mingw-glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1929850]

Comment 5 Riccardo Schirone 2021-05-13 15:41:15 UTC

This issue is about an integer truncation that occurs only when an application uses g_byte_array_new_take (or inderectly uses it, like with g_bytes_unref_to_array), provides a way for an attacker to provide both size and data and that could lead to at most an impact on the availability of the application/service. Moreover, if the application correctly uses the array->len field to determine the size of the GBytesArray, where array is the GBytesArray returned by g_byte_array_new_take/g_bytes_unref_to_array, no other direct security problem could happen because the stored length is less than what initially was. For these reason, this flaw got a Moderate Impact.

Comment 10 errata-xmlrpc 2021-08-10 13:15:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3058 https://access.redhat.com/errata/RHSA-2021:3058

Comment 11 Product Security DevOps Team 2021-08-10 13:28:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27218

Comment 12 errata-xmlrpc 2021-11-09 19:06:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4526 https://access.redhat.com/errata/RHSA-2021:4526