Bug 842460 (CVE-2012-4025)

Summary:	CVE-2012-4025 squashfs-tools: integer overflow in queue_init() may lead to abitrary code execution
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bruno, peterm, phillip.lougher, plougher, tcallawa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:58:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	847270
Bug Blocks:	842461

Description Vincent Danen 2012-07-23 22:29:57 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4025 to
the following vulnerability:

Name: CVE-2012-4025
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4025
Assigned: 20120716
Reference: http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
Reference: OSVDB:83899
Reference: http://www.osvdb.org/83899

Integer overflow in the queue_init function in unsquashfs.c in
unsquashfs in Squashfs 4.2 and earlier allows remote attackers to
execute arbitrary code via a crafted block_log field in the superblock
of a .sqsh file, leading to a heap-based buffer overflow.

Comment 1 Bruno Wolff III 2012-07-24 02:47:02 UTC

I'll keep an eye out for patches for this. Based on the discussion on the source forge list, I don't think anything is likely to happen soon. Phillip considers the two recent bugs to be relatively minor (I think that assessment is correct), he doesn't have a lot of time right now and the reporter has irked him.
There appear to be fixes to check for other kinds of corruption queued up that may also cause similar issues. I have been keeping an eye out for a 4.3 release, as I am not sure what shape Phillip considers the current trunk to be in.

If people think this really warrants a relatively rapid response I can look into seeing if I can find or make fixes?

Comment 2 Stefan Cornelius 2012-07-27 09:59:38 UTC

RHEL5 is not affected, as it does not support parallel processing and does not use queues.

Comment 4 Stefan Cornelius 2012-08-10 11:07:04 UTC

Created squashfs-tools tracking bugs for this issue

Affects: fedora-all [bug 847270]

Comment 5 Stefan Cornelius 2012-08-17 08:59:37 UTC

Statement:

This issue did not affect the versions of squashfs-tools as shipped with Red Hat Enterprise Linux 5 as they did not include support for parallel processing and do not make use of queues.

Comment 6 Bruno Wolff III 2012-11-25 21:57:10 UTC

There is an upstream commit for this. I am looking at backporting it now.
http://squashfs.git.sourceforge.net/git/gitweb.cgi?p=squashfs/squashfs;a=commit;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e

Comment 7 Bruno Wolff III 2012-11-26 01:04:59 UTC

I have updates for rawhide, f16, f17 and f18.

Comment 8 Fedora Update System 2012-12-12 00:17:45 UTC

squashfs-tools-4.2-5.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2012-12-13 05:55:58 UTC

squashfs-tools-4.2-5.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2012-12-13 05:58:27 UTC

squashfs-tools-4.2-5.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Bruno Wolff III 2012-12-13 13:11:23 UTC

Note that squashfs tools 4.3 is due out in a few weeks and will have fixes for a number of potential issues with handling bad data.

Comment 12 Vincent Danen 2012-12-20 21:17:24 UTC

Please don't close SRT bugs; this needs to remain open for RHEL6 where it is deferred.

Comment 13 Bruno Wolff III 2012-12-20 21:30:38 UTC

Should I have closed 847270 now that all of the Fedora instances have fixes?

Comment 14 Vincent Danen 2012-12-20 22:04:35 UTC

Yeah, closing the Fedora bug would be good.  Thanks.