Bug 2272482 (CVE-2024-27099)

Summary:	CVE-2024-27099 python-uamqp-azure: Double free at link.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	epacific, jcammara, jhardy, jneedle, jobarker, mabashia, simaishi, smcdonal, teagle, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A double free vulnerability was found in python-uamqp-azure affecting the embedded azure-uamqp-c library at the link.c file. If some uncommon conditions are met, an authenticated user may cause remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2272483
Bug Blocks:	2272487

Description Pedro Sampaio 2024-04-01 14:36:02 UTC

The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices if the preferred protocol to the hub service is the AMQP protocol.

The vulnerability results from a situation where the uAMQP library attempts to free the same memory location twice while processing an incorrect “AMQP_VALUE” failed state which may lead to possible RCE. This may occur when a memory allocation has failed (usually due to a low memory event).

References:

https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-6rh4-fj44-v4jj
https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987
https://salsa.debian.org/python-team/packages/azure-uamqp-python/-/commit/8bde200226d14a5f4c36f73a270bd957a31d7f96#903ba3297d39cbee4afd35664e80f1b0ae609206_0_1

Comment 1 Pedro Sampaio 2024-04-01 14:36:19 UTC

Created python-uamqp tracking bugs for this issue:

Affects: fedora-all [bug 2272483]