Bug 794766 (CVE-2012-0864)
| Summary: | CVE-2012-0864 glibc: FORTIFY_SOURCE format string protection bypass via "nargs" integer overflow | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Stefan Cornelius <scorneli> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | fweimer, jakub, law, lersek, mfranc, schwab |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-03-20 09:16:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 794797, 794813, 794814, 794815, 794817 | ||
| Bug Blocks: | 790425 | ||
|
Description
Stefan Cornelius
2012-02-17 15:11:58 UTC
*** Bug 794763 has been marked as a duplicate of this bug. *** A CVE identifier of CVE-2012-0864 has been assigned to this issue. Presumably you're going to create the appropriate RHEL & Fedora bugs to track this issue? It looks like Kees posted an updated patch yesterday; I haven't seen any replies to that submission yet. http://cygwin.com/ml/libc-alpha/2012-02/msg00328.html This issue affects the version of the glibc package, as shipped with Red Hat Enterprise Linux 5 and 6. This issue affects the version of the glibc package, as shipped with Fedora release of 15 and 16. The child bugs for affected versions will follow shortly. Created glibc tracking bugs for this issue Affects: fedora-all [bug 794797] (Learned about this on LWN today.) (In reply to comment #3) > It looks like Kees posted an updated patch yesterday; I haven't seen any > replies to that submission yet. > > http://cygwin.com/ml/libc-alpha/2012-02/msg00328.html The easiest fix would have been to restrict "nargs" to NL_ARGMAX. http://www.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html#tag_13_23_03_07 $ cat /etc/redhat-release Red Hat Enterprise Linux Workstation release 6.2 (Santiago) $ getconf NL_ARGMAX 4096 I guess with the patch that went in an attacker could still force an allocation attempt of eg. 1.5 GB on the heap. I think it's plain unreasonable to allow that. 4096 numbered arguments should be enough for anyone (TM), including field width, precision, and "normal data" args. Fix committed upstream in: http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7c1f4834d398163d1ac8101e35e9c36fc3176e6e Followed by a correction patch that sets errno correctly in case of the failure: http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=fa0355175d60ccf610c98f2345504603d3b8ea57 Related discussion starts at: http://sourceware.org/ml/libc-alpha/2012-03/msg00053.html Yea saw it this morning. The setting of errno is fairly minor; I've pulled that into our 6.3 tree and will pull it into our 5.9 tree shortly. I don't think it's worth respinning 5.8-z or 6.2-z just to pick up those two errno settings. (In reply to comment #8) > The easiest fix would have been to restrict "nargs" to NL_ARGMAX. Bounced your proposal to libc-alpha: http://sourceware.org/ml/libc-alpha/2012-03/msg00101.html Upstream preference is to only limit by the available memory, rather than using any other arbitrary limit. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2012:0393 https://rhn.redhat.com/errata/RHSA-2012-0393.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2012:0397 https://rhn.redhat.com/errata/RHSA-2012-0397.html Already fixed in Fedora via: https://admin.fedoraproject.org/updates/FEDORA-2012-2144/glibc-2.14.1-6 https://admin.fedoraproject.org/updates/FEDORA-2012-2162/glibc-2.14.90-24.fc16.6 https://admin.fedoraproject.org/updates/FEDORA-2012-2123/glibc-2.15-23.fc17 This issue has been addressed in following products: RHEV-H, V2V and Agents for RHEL-5 Via RHSA-2012:0488 https://rhn.redhat.com/errata/RHSA-2012-0488.html This issue has been addressed in following products: RHEV-H and Agents for RHEL-6 Via RHSA-2012:0531 https://rhn.redhat.com/errata/RHSA-2012-0531.html |