Bug 2026685 (CVE-2020-28163)

Summary:	CVE-2020-28163 libdwarf: NULL pointer dereference due to corrupt line table header
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caswilli, fche, jitesh.1337, kaycoth, orion
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libdwarf-0.3.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in libdwarf. A possible null pointer dereference vulnerability allows an attacker to input a specially crafted file, leading to a crash. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2027699
Bug Blocks:	2026686

Description Guilherme de Almeida Suckevicz 2021-11-25 14:00:15 UTC

If a DWARF5 line table header has an invalid FORM for a pathname, the fi_file_name field may be null and printing it via %s can result in referencing memory at address 0, possibly generating segmentation violation or application crash. Now in case of null we provide a fixed string of <no file name> and for the form code we print the value and <unknown form> so there are no unpredictable effects.

Reference:
https://www.prevanders.net/dwarfbug.html

Upstream patch:
https://github.com/davea42/libdwarf-code/commit/faf99408e3f9f706fc3809dd400e831f989778d3

Comment 1 Tom Hughes 2021-11-25 14:11:22 UTC

Please stop subscribing me to bugs wihout my permission.

I am the maintainer for the Fedora builds of libdwarf and bugzilla will automatically include me on any bugs you open against it for Fedora.

I do not need to be added to bugs RedHat use for their internal security response administration.