Bug 2209114 (CVE-2023-2602)

Summary:	CVE-2023-2602 libcap: Memory Leak on pthread_create() Error
Product:	[Other] Security Response	Reporter:	juneau
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ansasaki, bdettelb, jmitchel, jtanner, kshier, lgriffin, rsroka
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2210645, 2210641, 2210643, 2210644, 2222197, 2222198
Bug Blocks:	2207492

Description juneau 2023-05-22 16:54:30 UTC

Original Report:

Source: libcap2
Version: 1:2.66-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil, Debian Security Team <team.org>

The following vulnerabilities were published for libcap2.

CVE-2023-2602[0]:
| LCAP-CR-23-01 (Correct the check of pthread_create()'s return value)

[0] https://security-tracker.debian.org/tracker/CVE-2023-2602
    https://www.cve.org/CVERecord?id=CVE-2023-2602

fixed in 1:2.66-4

Comment 2 Sandipan Roy 2023-05-29 04:16:04 UTC

Created libcap tracking bugs for this issue:

Affects: fedora-37 [bug 2210641]
Affects: fedora-38 [bug 2210643]

Comment 7 errata-xmlrpc 2023-08-08 08:19:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4524 https://access.redhat.com/errata/RHSA-2023:4524

Comment 8 errata-xmlrpc 2023-09-12 10:13:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5071 https://access.redhat.com/errata/RHSA-2023:5071

Comment 10 errata-xmlrpc 2023-11-21 11:41:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:7400 https://access.redhat.com/errata/RHSA-2023:7400