Bug 645859 (CVE-2010-4051, CVE-2010-4052)

Summary: CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: fweimer, jakub, pbonzini, schwab, security-response-team, wnefal+redhatbugzilla
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20101207,reported=20101022,source=cert,impact=low,cvss2=2.1/AV:L/AC:L/Au:N/C:N/I:N/A:P,rhel-3/glibc=affected,rhel-4/glibc=affected,rhel-5/glibc=affected,rhel-6/glibc=affected,fedora-all/glibc=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-06-03 05:40:49 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Jan Lieskovsky 2010-10-22 13:01:05 EDT 
Maksymilian Arciemowicz reported a deficiency in the way
glibc regular expression engine processed certain patterns.
A local attacker could use this flaw to cause a denial of 
service (crash due stack overflow).

Note: The above described behavior is a limitation of glibc
regular expression engine. Regular expression matching 
function is called recursively for certain types of patterns 
(where subexpression using quantifier is nested inside of 
another quantified expression), where long input can result 
in deep recursion and exhaustion of all stack memory (i.e. 
impact is limited to crash). Amount of stack memory available
to glibc regular expression engine influences the size of input 
that must be provided to trigger the crash. Alternatively, 
expression can be modified to avoid quantification nesting, 
or program modified to limit size of input passed to regular
expression engine.

Conclusion: Due the above described behavior Red Hat Security
Response Team would not classify this deficiency to be a security
issue.

References:
[1] http://www.kb.cert.org/vuls/id/912279
[2] http://www.securityfocus.com/archive/1/515589
[3] http://forums.cnet.com/7726-6132_102-5042238.html
[4] http://secunia.com/advisories/42547/
[5] http://securityreason.com/securityalert/8003
Comment 3 Jan Lieskovsky 2010-11-30 09:09:20 EST 
The CVE identifier of CVE-2010-4051 has been assigned for
the crash due large values in an "{n,}" sequence issue.

The CVE identifier of CVE-2010-4052 has been assigned
for the stack exhaustion issue.
Comment 5 Jan Lieskovsky 2011-01-10 10:40:18 EST 
Full-disclosure post:
[1] http://seclists.org/fulldisclosure/2011/Jan/78
Comment 6 Jan Lieskovsky 2011-01-10 11:00:23 EST 
Statement:

Red Hat does not consider crash of client application, using regcomp() 
or regexec() routines on untrusted input without preliminary checking 
the input for the sanity, to be a security issue (the described deficiency 
implies and is a known limitation of the glibc regular expression engine 
implementation). The expressions can be modified to avoid quantification 
nesting, or program modified to limit size of input passed to regular 
expression engine. We do not currently plan to fix these flaws. If more 
information becomes available at a future date, we may revisit these issues.
Comment 11 Jan Lieskovsky 2011-06-03 05:22:30 EDT 
These issues affect the versions of the glibc package, as shipped with
Red Hat Enterprise Linux 4, 5, and 6.
Comment 13 Jan Lieskovsky 2011-06-03 05:40:49 EDT 
Closing as not a bug due conclusion in:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=645859#c6