Bug 912400 (CVE-2013-0338)

Summary:	CVE-2013-0338 libxml2: CPU consumption DoS when performing string substitutions during entities expansion
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mnowak, paul, security-response-team, veillard
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-28 19:23:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	912572, 912573, 912574, 912575, 912954, 912955
Bug Blocks:	912428

Description Jan Lieskovsky 2013-02-18 15:40:11 UTC

A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).

Comment 2 Jan Lieskovsky 2013-02-18 16:03:41 UTC

This issue affects the versions of the libxml2 package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the libxml2 package, as shipped with Fedora release of 17 and 18.

--

This issue affects the versions of the libxml package, as shipped with Fedora release of 17 and 18.

Comment 6 Huzaifa S. Sidhpurwala 2013-02-20 04:09:37 UTC

Created libxml2 tracking bugs for this issue

Affects: fedora-all [bug 912954]

Comment 7 Huzaifa S. Sidhpurwala 2013-02-20 04:09:40 UTC

Created libxml tracking bugs for this issue

Affects: fedora-all [bug 912955]

Comment 11 Huzaifa S. Sidhpurwala 2013-02-25 05:20:37 UTC

This issue has been assigned CVE-2013-0338 as per:

http://seclists.org/oss-sec/2013/q1/391

Comment 12 Huzaifa S. Sidhpurwala 2013-02-25 05:25:03 UTC

Upstream patch:

http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab

Comment 13 errata-xmlrpc 2013-02-28 18:56:47 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2013:0581 https://rhn.redhat.com/errata/RHSA-2013-0581.html

Comment 14 Tomas Hoger 2014-05-12 20:13:21 UTC

This CVE was assigned to a variant of the "billion-laughs" attack, a common attack class against XML parser.  This type of attack uses entity references that get replaced by a long string, which causes XML parser to use excessive amount of memory and CPU time.

The libxml2 previously got fixes to block this type of attack - see CVE-2003-1564 (bug 461107) and CVE-2008-3281 (bug 458086).  Those fixes added heuristics that blocked the original attack, which uses a series of entity expansion, with each entity definition using short replacement string.  For example, entity 'a' may be defined to expand to two or more entity 'b' references, entity 'b defined to expand to two or more entity 'c' references, etc.  A single use of &a; reference in the document leads to expansion with exponential complexity.

This variant uses entity definition that expands to a very long string.  The XML document needs to contain many references to such entity, which leads to linear complexity, but could still trigger high memory and CPU use.  The additional patch adds further checks to block this variant.