Bug 2284252 (CVE-2024-36843)

Summary:	CVE-2024-36843 libmodbus: heap overflow
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	esandeen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-07-17 16:16:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2284253, 2284254
Bug Blocks:

Description ybuenos 2024-06-02 14:14:14 UTC

libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function.

https://github.com/stephane/libmodbus/issues/748

Comment 1 ybuenos 2024-06-02 14:14:33 UTC

Created libmodbus tracking bugs for this issue:

Affects: epel-all [bug 2284254]
Affects: fedora-all [bug 2284253]

Comment 2 Eric Sandeen 2024-07-17 16:16:27 UTC

This has been fixed since 3.1.7, see https://github.com/stephane/libmodbus/issues/748

b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6 is the first bad commit
commit b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6
Author: Michael Heimpold <mhei>
Date:   Sat Jan 8 20:00:50 2022 +0100

    modbus_reply: fix copy & paste error in sanity check (fixes #614)
    
    While handling MODBUS_FC_WRITE_AND_READ_REGISTERS, both address offsets
    must be checked, i.e. the read and the write address must be within the
    mapping range.
    
    At the moment, only the read address was considered, it looks like a
    simple copy and paste error, so let's fix it.
    
    Signed-off-by: Michael Heimpold <mhei>

 src/modbus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

version 3.1.7 is in EPEL8, EPEL9, Fedora 39, and Fedora 40, so no current releases are affected. Closing NOTABUG because it has already been fixed.