Bug 2102598 (CVE-2022-33070)

Summary: CVE-2022-33070 protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: areber, cse.cem+redhatbugz
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in protobuf-c. The issue occurs due to an invalid arithmetic shift via the parse_tag_and_wiretype in the protobuf-c/protobuf-c.c function. This flaw allows attackers to cause a denial of service (DoS) via unspecified vectors.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2102599, 2102961, 2102962    
Bug Blocks: 2102600    

Description Marian Rehak 2022-06-30 10:13:40 UTC
An invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Reference:

https://github.com/protobuf-c/protobuf-c/pull/508
https://github.com/protobuf-c/protobuf-c/issues/506

Comment 1 Marian Rehak 2022-06-30 10:13:54 UTC
Created protobuf-c tracking bugs for this issue:

Affects: fedora-all [bug 2102599]