Bug 682332 (CVE-2011-0188)
| Summary: | CVE-2011-0188 ruby: memory corruption in BigDecimal on 64bit platforms | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amarecek, jlieskov, security-response-team, vondruch |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-06-29 14:35:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 709957, 709958, 709959, 709963, 709964 | ||
| Bug Blocks: | |||
Acknowledgements: Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue. This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:0908 https://rhn.redhat.com/errata/RHSA-2011-0908.html This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0910 https://rhn.redhat.com/errata/RHSA-2011-0910.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0909 https://rhn.redhat.com/errata/RHSA-2011-0909.html Statement: (none) |
Drew Yao of Apple Product Security reported a flaw in how Ruby's BigDecimal implementation. In a 64-bit program, if the amount of memory to allocate is greater than 2^32, the allocated amount will be truncated to a 32-bit unsigned integer, however the amount to memset will use the full 64-bit number, leading to a crash or memory corruption. After the memset, the unexpectedly small buffer could be used in other ways that lead to memory corruption or, possibly, code execution. This flaw only affects 64-bit processes. To test whether or not ruby is vulnerable, the following can be used (on a vulnerable ruby it will cause a segfault): $ ruby -e 'require "bigdecimal"; BigDecimal.new("8").**(0x20000000)' Upstream committed the following to fix the flaw: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993