Bug 2258948 (CVE-2024-0684)

Summary: CVE-2024-0684 coreutils: heap overflow in split --line-bytes with very long lines
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: coreutils 9.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2258913    
Bug Blocks: 2258947    

Description Rohit Keshri 2024-01-18 07:15:46 UTC 
Since coreutils 9.2 https://github.com/coreutils/coreutils/commit/40bf1591b
introduced a heap overflow issue, which can be triggered like:

    { printf '%131070s\n' ''; printf 'x\n'; printf '%131071s\n' ''; } > in
    split -C 131072 ---io=131072 in

That will dump core, but as with all heap overflows is a potential security issue.
I'll leave it up to you to determine whether a CVE is required.

There is already a patch upstream, but it's not flagged as a security issue,
in an abundance of caution, in case this issue in more security sensitive than first envisaged. The upstream patch is:
https://github.com/coreutils/coreutils/commit/c4c5ed8f4.patch
Comment 1 Rohit Keshri 2024-01-18 07:20:12 UTC 
https://bugzilla.redhat.com/show_bug.cgi?id=2258913
Comment 3 Mauro Matteo Cascella 2024-01-18 13:59:39 UTC 
Created coreutils tracking bugs for this issue:

Affects: fedora-all [bug 2258913]