Bug 2160092 (CVE-2022-46285)

Summary:	CVE-2022-46285 libXpm: Infinite loop on unclosed comments
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	btissoir, peter.hutterer, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libXpm 3.5.15	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-02-22 16:03:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2160229, 2160230, 2161709, 2161796, 2161797, 2161800, 2161801, 2161802, 2161803, 2161805
Bug Blocks:	2159932

Description Guilherme de Almeida Suckevicz 2023-01-11 14:12:59 UTC

When reading XPM images from a file with libXpm 3.5.14 or older, if a comment in the file is not closed (i.e. a C-style comment starts with "/*" and is missing the closing "*/"), the ParseComment() function will loop forever calling getc() to try to read the rest of the comment, failing to notice that it has returned EOF, which may cause a denial of service to the calling program.

Comment 6 Guilherme de Almeida Suckevicz 2023-01-17 17:04:38 UTC

Created libXpm tracking bugs for this issue:

Affects: fedora-all [bug 2161709]

Comment 7 Guilherme de Almeida Suckevicz 2023-01-17 17:06:45 UTC

Reference:
https://lists.x.org/archives/xorg-announce/2023-January/003312.html

Upstream patch:
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d7650148

Comment 8 errata-xmlrpc 2023-01-23 17:52:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:0384 https://access.redhat.com/errata/RHSA-2023:0384

Comment 9 errata-xmlrpc 2023-01-23 17:53:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:0380 https://access.redhat.com/errata/RHSA-2023:0380

Comment 10 errata-xmlrpc 2023-01-23 17:53:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0383 https://access.redhat.com/errata/RHSA-2023:0383

Comment 11 errata-xmlrpc 2023-01-23 17:54:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0379 https://access.redhat.com/errata/RHSA-2023:0379

Comment 12 errata-xmlrpc 2023-01-23 17:55:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:0378 https://access.redhat.com/errata/RHSA-2023:0378

Comment 13 errata-xmlrpc 2023-01-23 17:56:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:0381 https://access.redhat.com/errata/RHSA-2023:0381

Comment 14 errata-xmlrpc 2023-01-23 17:58:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:0382 https://access.redhat.com/errata/RHSA-2023:0382

Comment 15 Product Security DevOps Team 2023-02-22 16:03:30 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-46285