Bug 889935 (CVE-2012-5667)
| Summary: | CVE-2012-5667 grep: Integer overflow leading to heap-based buffer-overflow when reading large lines | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | low | Docs Contact: | |||||||
| Priority: | low | ||||||||
| Version: | unspecified | CC: | jlieskov, jrusnack, jskarvad, lkundrak | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | grep 2.11 | Doc Type: | Bug Fix | ||||||
| Doc Text: |
An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way grep parsed large lines of data. An attacker able to trick a user into running grep on a specially crafted data file could use this flaw to crash grep or, potentially, execute arbitrary code with the privileges of the user running grep.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2015-07-22 18:12:00 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 1198218 | ||||||||
| Bug Blocks: | 889936, 1183652, 1193283 | ||||||||
| Attachments: |
|
||||||||
|
Description
Huzaifa S. Sidhpurwala
2012-12-24 04:57:00 UTC
Upstream suggests that this issue only affects grep < 2.11 This issue affects the version of grep package as shipped with Fedora-16. This issue does NOT affect the version of grep package as shipped with Fedora-17. (Other) References: ------------------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5667 http://lists.gnu.org/archive/html/bug-grep/2012-12/msg00004.html http://openwall.com/lists/oss-security/2012/12/22/6 http://git.savannah.gnu.org/cgit/grep.git/commit/?id=8fcf61523644df42e1905c81bed26838e0b04f91 http://git.savannah.gnu.org/cgit/grep.git/commit/?id=cbbc1a45b9f843c811905c97c90a5d31f8e6c189 http://git.sv.gnu.org/gitweb/?p=grep.git;a=shortlog;h=v2.11 https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473 I am unable to reproduce the crash on F16. 64 bit machine with 4 GB RAM: # perl -e 'print "x"x(2**31)' | grep x > /dev/null grep: memory exhausted # grep --version grep (GNU grep) 2.9 Statement: This issue did not affect the version of grep as shipped with Red Hat Enterprise Linux 5. Created attachment 686585 [details]
Proposed fix
This is proposed fix/workaround for the problem. It is not clean solution, but it shouldn't have side-effects.
Created attachment 686605 [details]
Proposed fix (to cover boundary case)
# perl -e 'print "x"x(1073741823)' | LANG=c grep x > /dev/null
# perl -e 'print "x"x(1073741824)' | LANG=c grep x > /dev/null
grep: line too long
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2015:1447 https://rhn.redhat.com/errata/RHSA-2015-1447.html |