Bug 1949687 (CVE-2021-3504)

Summary:	CVE-2021-3504 hivex: Buffer overflow when provided invalid node key length
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gkamathe, rjones, security-response-team, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	hivex-1.3.20	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the hivex library. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-01 07:35:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1950500, 1950501, 1950917, 1952988, 1956204, 1957103
Bug Blocks:	1949688, 1950347

Description Pedro Sampaio 2021-04-14 19:48:38 UTC

A flaw was found in libhivex. It's possible to provide a large length value for a node which can read past the end of the file leading to read of arbitrary memory and other potential consequences.

Comment 21 gkamathe 2021-04-20 07:27:42 UTC

Statement:

This flaw affects all previous hivex versions up to version 1.3.19

Comment 24 gkamathe 2021-05-03 08:05:50 UTC

Upstream fix: https://github.com/libguestfs/hivex/commit/8f1935733b10d974a1a4176d38dd151ed98cf381

Comment 25 gkamathe 2021-05-03 08:08:15 UTC

Created hivex tracking bugs for this issue:

Affects: fedora-all [bug 1956204]

Comment 27 gkamathe 2021-05-12 13:15:56 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 28 errata-xmlrpc 2021-06-08 22:33:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2318 https://access.redhat.com/errata/RHSA-2021:2318

Comment 30 errata-xmlrpc 2021-08-10 13:50:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3061 https://access.redhat.com/errata/RHSA-2021:3061