Bug 912400 (CVE-2013-0338)

Summary: CVE-2013-0338 libxml2: CPU consumption DoS when performing string substitutions during entities expansion
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: mnowak, paul, security-response-team, veillard
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130219,reported=20130218,source=upstream,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P,rhel-5/libxml2=affected,rhel-6/libxml2=affected,rhel-6/mingw32-libxml2=wontfix,fedora-all/libxml2=affected,fedora-all/libxml=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-02-28 14:23:25 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 912572, 912573, 912574, 912575, 912954, 912955    
Bug Blocks: 912428    

Description Jan Lieskovsky 2013-02-18 10:40:11 EST
A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).
Comment 2 Jan Lieskovsky 2013-02-18 11:03:41 EST
This issue affects the versions of the libxml2 package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the libxml2 package, as shipped with Fedora release of 17 and 18.

--

This issue affects the versions of the libxml package, as shipped with Fedora release of 17 and 18.
Comment 6 Huzaifa S. Sidhpurwala 2013-02-19 23:09:37 EST
Created libxml2 tracking bugs for this issue

Affects: fedora-all [bug 912954]
Comment 7 Huzaifa S. Sidhpurwala 2013-02-19 23:09:40 EST
Created libxml tracking bugs for this issue

Affects: fedora-all [bug 912955]
Comment 11 Huzaifa S. Sidhpurwala 2013-02-25 00:20:37 EST
This issue has been assigned CVE-2013-0338 as per:

http://seclists.org/oss-sec/2013/q1/391
Comment 12 Huzaifa S. Sidhpurwala 2013-02-25 00:25:03 EST
Upstream patch:

http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab
Comment 13 errata-xmlrpc 2013-02-28 13:56:47 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2013:0581 https://rhn.redhat.com/errata/RHSA-2013-0581.html
Comment 14 Tomas Hoger 2014-05-12 16:13:21 EDT
This CVE was assigned to a variant of the "billion-laughs" attack, a common attack class against XML parser.  This type of attack uses entity references that get replaced by a long string, which causes XML parser to use excessive amount of memory and CPU time.

The libxml2 previously got fixes to block this type of attack - see CVE-2003-1564 (bug 461107) and CVE-2008-3281 (bug 458086).  Those fixes added heuristics that blocked the original attack, which uses a series of entity expansion, with each entity definition using short replacement string.  For example, entity 'a' may be defined to expand to two or more entity 'b' references, entity 'b defined to expand to two or more entity 'c' references, etc.  A single use of &a; reference in the document leads to expansion with exponential complexity.

This variant uses entity definition that expands to a very long string.  The XML document needs to contain many references to such entity, which leads to linear complexity, but could still trigger high memory and CPU use.  The additional patch adds further checks to block this variant.