Bug 523258 (CVE-2008-7224)
| Summary: | CVE-2008-7224 elinks: entity_cache static array buffer overflow (off-by-one) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | kreilly, mjc, ovasik | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| URL: | http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347 | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2009-10-01 18:16:31 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 525695, 525696, 525697, 525698, 833894 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
|
Description
Jan Lieskovsky
2009-09-14 15:48:37 UTC
This issue does NOT affect the version of the elinks package, as shipped with Red Hat Enterprise Linux 3. This issue affects the versions of the elinks package, as shipped with Red Hat Enterprise Linux 4 and 5. Created attachment 360964 [details] Local copy of upstream CVE-2008-7224 patch. This bugs cause overflow (off-by-one) of entity_cache array, as last+1 entry was first initialized before array's upper bound was checked. Out-of-array write can only be triggered by 8-character entities (shorter may also cause writes to unintended places, but all within entity_cache array).
Following structure is written past the array end:
396 struct entity_cache {
397 unsigned int hits;
398 int strlen;
399 int encoding;
400 unsigned char *result;
401 unsigned char str[20]; /* Suffice in any case. */
402 };
Out of the members, attacker may control encoding (possible values are very limited though), first 8 chars of str[] and possibly hits (though elinks may crash before hits gets incremented to a desired value).
As entity_cache is static array, real impact is not easily predictable, as it depends what other static data are placed right behind the array and how those are used. This may not be as easy to reproduce reliably as stack / heap overflow. I'm able to get crash on RHEL5/i386 version, but not on RHEL4 version.
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:1471 https://rhn.redhat.com/errata/RHSA-2009-1471.html |