Bug 749324 (CVE-2011-4079)
Summary: | CVE-2011-4079 openldap: one-byte buffer overflow in slapd | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED NOTABUG | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | jvcelak, rcvalle, rmeggins, ykaul |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2011-11-03 11:24:12 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 749328 |
Description
Vincent Danen
2011-10-26 18:02:50 UTC
Doug Lea's Malloc stores chunks whose size is smaller than 512 bytes in one of the small bins, which holds identically sized chunks. The size of a chunk is always a multiple of 8 bytes, and the first small bin holds 16 bytes chunks. Since the minimum allocated size is 16 bytes, it seems no data that can result in application crash can be overwritten as a result of this. Resolved in Fedora Rawhide (openldap-2.4.26-6.fc17). Statement: The Red Hat Security Response Team does not consider this to be a security issue. For additional information, refer to: https://bugzilla.redhat.com/show_bug.cgi?id=749324#c1. For additional information, OpenLDAP has a Slab Allocator implementation atop of glibc malloc with the size of its allocated objects rounded up to double word boundaries, which is also its minimum size. Thus, this can not even be called an off-by-one when not falling back to glibc malloc. |