Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Basically if an fstream bytewise write using `stream->putc()` fails due
to an error (e.g. a transient disk failure or ENOSPCE), the operation
ends up writing the char into the backing buffer anyway and multiple
such operations could eventually result in writing arbitrary bytes
beyond the backing buffer. Note that a typical stream write (i.e.
stream << "foo" ) is not affected by this.
Requisites for an attack:
1. Ability to invoke a write failure by, e.g. chaining a different
vulnerability that allows such access
2. Finding a target suid application or service that calls
`stream->putc()` in a user-controlled path
3. Ability to already control the execution frequency of
`stream->putc()` to cause a buffer overflow.
There are no suid applications that use this pattern AFAIK, so I don't
think there's a local attack vector here at all, only a network one
through a service. There's no confidentiality compromise either AFAICT,
there's only a minor risk of data corruption and a small incremental
(given the already compromised ability to invoke a storage failure) risk
of DoS due to invoking a crash in the target service that meets all of
the above criteria.