Bug 1991962 (CVE-2021-29922)

Summary:	CVE-2021-29922 rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amulhern, bodavis, emachado, igor.raits, jistone, jpadman, mnewsome, rust-sig, TicoTimo
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rust 1.53.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in rust. Extraneous zero characters at the beginning of an IP address string are not properly considered which can allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 23:37:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1994684, 1994701
Bug Blocks:	1991963

Description Guilherme de Almeida Suckevicz 2021-08-10 13:41:23 UTC

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

References:
https://github.com/rust-lang/rust/issues/83648
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-015.md

Upstream patch:
https://github.com/rust-lang/rust/pull/83652

Comment 3 Todd Cullum 2021-08-17 19:19:38 UTC

Flaw summary:

Rust standard library's IpV4Addr would interpret leading zeroes like 0127.0.0.1 as the address 127.0.0.1. However, some applications may expect this same literal to be interpreted as 87.0.0.1 due to the original IPv4 specification allowing octal numbers. The upstream patch simply rejects octal numbers rather than parsing them as decimal.

Comment 5 errata-xmlrpc 2021-11-09 18:01:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4270 https://access.redhat.com/errata/RHSA-2021:4270