Bug 2234896 (CVE-2020-35357)

Summary:	CVE-2020-35357 gsl: Stack buffer overflow in gsl_stats_quantile_from_sorted_data
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	pcahyna
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A stack buffer overflow flaw was found in the gsl package due to a lack of validation of the user controlled fraction parameter. This issue may allow an attacker to craft malicious input, leading to a segmentation fault and further Denial of Service. Since the buffer overflow happens when reading data from the input array, it's very unlikely to achieve arbitrary code execution using this flaw.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2234897, 2234898, 2234899, 2234900, 2243104
Bug Blocks:	2234901

Description Pedro Sampaio 2023-08-25 17:44:07 UTC

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.

References:

https://savannah.gnu.org/bugs/?59624
https://git.savannah.gnu.org/cgit/gsl.git/commit/?id=989a193268b963aa1047814f7f1402084fb7d859

Comment 2 Marco Benatto 2023-10-10 18:34:11 UTC

Created gsl tracking bugs for this issue:

Affects: fedora-all [bug 2243104]

Comment 3 Marco Benatto 2023-10-10 18:41:41 UTC

Upstream commit for this issue:
https://git.savannah.gnu.org/cgit/gsl.git/commit/?id=989a193268b963aa1047814f7f1402084fb7d859

Comment 4 Marco Benatto 2023-10-10 18:58:55 UTC

The buffer overflow happens at gsl_stats_quantile_from_sorted_data() function from statistics/quantiles_source.c when the `f` parameter is outside the expected value (a fraction between 0 and 1), causing a out-of-bounds read of user-controlled data array parameter in one of following lines:

if (lhs == n - 1)                                                                                
  {                                                                                              
    result = sorted_data[lhs * stride] ;   <--------------------------------------------------------------------------                                                      
  }                                                                                              
else                                                                                             
  {                                                                                              
    result = (1 - delta) * sorted_data[lhs * stride] + delta * sorted_data[(lhs + 1) * stride] ; <--------------------
  }                                                                                              
                                                                                                 
as a result the application using the function will crash with a segmentation fault. Since the buffer overflow happens when reading that and the base array is provided by the user, it's very unlikely an attacker could achieve arbitrary code execution.