Bug 1009643 - (CVE-2012-6686, CVE-2013-4357) CVE-2012-6686 CVE-2013-4357 glibc: stack overflow in getaddrinfo()'s use of alloca()
CVE-2012-6686 CVE-2013-4357 glibc: stack overflow in getaddrinfo()'s use of a...
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20110413,repor...
: Security
Depends On:
Blocks: 1009645
  Show dependency treegraph
 
Reported: 2013-09-18 15:12 EDT by Vincent Danen
Modified: 2016-02-04 01:46 EST (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-10-28 02:03:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2013-09-18 15:12:17 EDT
It was reported [1],[2] that there are potential security problems with allocating memory in glibc's getaddrinfo() function.  As noted in the posting to the oss-security mailing list:

"I believe the analysis in this bug report is incorrect.  The security 
implications are unclear.  A straight copy of a long name to a stack 
buffer should trigger a crash because it hits the guard page, but even 
that could be a problem for daemons.

On the other hand, it's impossible to know for sure that no GCC version 
ever lays out the stack in such a way that we end up with a problem. 
Multi-threaded programs linking in script interpreters are more exposed 
to these problems, too."


[1] http://sourceware.org/bugzilla/show_bug.cgi?id=12671
[2] http://www.openwall.com/lists/oss-security/2013/08/22/4
Comment 3 Huzaifa S. Sidhpurwala 2013-10-28 02:01:28 EDT
This issue has been addressed in the previous versions of Red Hat Enterprise Linux 5 and 6 by the following advisories:

Red Hat Enterprise Linux 5:
http://rhn.redhat.com/errata/RHBA-2013-0022.html
https://bugzilla.redhat.com/show_bug.cgi?id=797096

Red Hat Enterprise Linux 6:
http://rhn.redhat.com/errata/RHBA-2012-0763.html
https://bugzilla.redhat.com/show_bug.cgi?id=797094
Comment 4 Huzaifa S. Sidhpurwala 2013-10-28 02:02:43 EDT
Statement:

This issue has already been addressed in Red Hat Enterprise Linux 5 via http://rhn.redhat.com/errata/RHBA-2013-0022.html and in Red Hat Enterprise Linux 6 via http://rhn.redhat.com/errata/RHBA-2012-0763.html
Comment 5 Huzaifa S. Sidhpurwala 2013-10-28 02:03:31 EDT
This issue does not affect the version of glibc as shipped with Fedora 18 and 19.
Comment 6 Martin Prpič 2015-02-24 08:00:49 EST
This issue was incorrectly assigned a duplicate CVE ID, CVE-2012-6686, and should be referred to by the original ID: CVE-2013-4357.

Note You need to log in before you can comment on or make changes to this bug.